Project CAV3RN Evolves with DNS-Based C2 Selection and Google Apps Script Relay
The Project CAV3RN espionage framework has been updated with sophisticated command and control (C2) capabilities, including dynamic channel selection via DNS and the use of Google Apps Script as a relay.
The modular espionage framework known as Project CAV3RN, previously documented as targeting entities in Israel, continues its evolution with significant enhancements to its command and control (C2) infrastructure. Recent analysis has uncovered new components that expand its communication capabilities, notably introducing a complex C2 module that leverages DNS A-record responses to dynamically switch between direct HTTPS communication and a Google Apps Script relay for each transaction. This sophisticated mechanism allows operators to maintain resilient C2 channels and rotate relay deployments with greater ease.
The core of these advancements lies in the GoogleService.dll module, a 64-bit component compiled using Microsoft .NET 8 NativeAOT. This module is responsible for managing the framework's communication protocols. It supports both direct HTTPS connections and communication through Google Apps Script, offering flexibility in how the malware communicates with its operators. Furthermore, the framework incorporates a local broker component designed to manage other DLL modules, route messages between them, and facilitate runtime upgrades, ensuring the framework can adapt and maintain persistence.
Upon initialization, the GoogleService.dll module registers with its host, the local broker, and initiates a check for availability. After a brief delay, it sends a type-0 frame to a fixed identifier, expecting a specific response from the broker that confirms its name before activating its C2 worker. C2 packets are structured with type, cid, and payload fields, with specific types handled by the communication module itself and others forwarded to the broker for processing. Commands within payloads are delimited by specific characters, allowing for clear instruction parsing.
The communication module supports several internal commands, including s_version which enumerates installed DLLs and their versions, providing an inventory of the compromised system's components. The s_config command allows for the retrieval and in-memory modification of the framework's configuration, though it does not persist these changes to disk unless it's a DNS recovery scenario. Diagnostic logging can be enabled or disabled using s_enLog and s_deLog respectively, aiding in debugging and operational stealth. The s_write command offers the capability to write data to specified file paths after Base64 decoding and GZip decompression.
A critical aspect of CAV3RN's new architecture is its C2 channel selection mechanism. Before initiating a command or sending a result, the module performs a DNS A-record query to a specific domain, m.studiotikva.com. This query includes a random nonce, an error state indicator, and the client's hexadecimal ID. The response from this DNS query, specifically the fourth octet of the IP address returned, dictates the communication channel to be used: Google Apps Script, Direct HTTPS, or in some cases, closing the transaction. This dynamic selection adds a layer of resilience against network defenses.
When the Google Apps Script channel is chosen, the module performs a validation check using the MD5 digest of its stored deployment ID against a response from a related DNS query. If the validation fails, it retrieves a replacement deployment ID through another DNS query. This DNS-based freshness check ensures that the relay deployment ID remains valid and operational, further enhancing the robustness of the C2 infrastructure.
The framework's configuration is managed via a conf.json file. If this file is absent, the module generates a unique client identifier and populates the configuration with default settings. These settings include URLs for direct C2 communication, DNS domains, Google Apps Script deployment IDs, logging preferences, poll delays, and authentication keys for the Apps Script relay. The ability to dynamically update these configurations, particularly the DNS recovery of the Apps Script deployment ID, highlights the framework's adaptive nature.
This continued development of Project CAV3RN underscores the persistent threat posed by sophisticated espionage frameworks. The integration of advanced C2 techniques, such as DNS-based channel selection and the use of legitimate cloud services like Google Apps Script as relays, demonstrates a clear effort by the threat actors to evade detection and maintain long-term access to targeted environments. The modular design and runtime upgrade capabilities further suggest a well-resourced and evolving threat.