As reported by The Hacker News, Kaspersky's continued tracking of the Cavern C2 framework reveals a sophisticated evolution in how Iranian state-sponsored operators are weaponing legitimate cloud infrastructure for stealthy command-and-control communications. The findings underscore a broader and deeply concerning trend: threat actors are no longer just hiding in the noise of legitimate traffic — they are becoming the legitimate traffic.

Threat Intelligence: The findings underscore a broader and deeply concerning trend: threat actors are no longer just hiding in the noise of legitimate traffic — they are becoming the legitimate traffic.

The Cavern framework, attributed to the Cavern Manticore group with documented overlaps to MuddyWater and OilRig (APT34), represents a maturing toolset that has transitioned to a modular plugin architecture since April 2026. What makes this iteration particularly notable is its multi-layered abuse of trusted services: DNS A-record responses dynamically selecting between direct HTTPS and Google Apps Script relays, and the HOLLOWGRAPH module turning Microsoft 365 calendars into bidirectional C2 dead-drops via the Graph API.

Why This Matters

The core challenge here is traffic legitimacy. Traditional network defense relies heavily on reputation-based filtering and anomaly detection. When an implant communicates through script.google.com or graph.microsoft.com, it generates requests that are functionally identical to normal business activity. Security tools that whitelist these domains — as most do — provide no visibility into the malicious transactions flowing through them.

The HOLLOWGRAPH module's use of future-dated calendar events (set to May 2050) as exfiltration containers is especially clever. It exploits a behavioral blind spot: calendar entries far in the future rarely trigger user-facing alerts, and file attachments to calendar events are an under-monitored data egress vector. Combined with DNS tunneling for Entra ID credential rotation, the entire chain is designed to survive token expiry and maintain persistence without interactive browser sessions.

Who Is at Risk

Why This Matters
Israeli and regional entities remain the primary targeting zone, but the TTPs are exportable and will likely proliferate to other Iranian-aligned operations.
Organizations heavily invested in Microsoft 365 and Google Workspace are structurally exposed — the attack surface is the SaaS stack itself, not a perimeter device.
Government, defense, and critical infrastructure sectors face the highest risk given the espionage-oriented mission profile of the threat actors involved.

Detection Gaps Defenders Must Close

Defenders should focus on behavioral rather than reputational signals. Key indicators worth investigating:

  • Microsoft Graph API anomalies: Calendar event creation at unusual future dates, especially with file attachments, initiated by service accounts or non-interactive OAuth tokens.
  • DNS tunneling patterns: High-volume TXT or A-record queries to a small set of domains with encoded subdomain patterns. Monitor for DNS query entropy and frequency anomalies.
  • Google Apps Script traffic: Outbound connections to script.google.com from endpoints that have no legitimate business need for Apps Script execution. Correlate with process telemetry.
  • Credential artifact persistence: Text files containing refreshed Entra ID tokens written to unexpected filesystem locations — a telltale sign of HOLLOWGRAPH's credential storage behavior.

Shield53 Recommendations

  • Audit OAuth application grants in Microsoft Entra ID and Google Workspace. Revoke tokens for unused or unrecognized applications. Implement conditional access policies that restrict Graph API access from non-compliant devices.
  • Deploy Microsoft Graph API logging through the Unified Audit Log and monitor for calendar event creation with abnormal date ranges or attachment patterns. Build detection rules for events dated more than 12 months in the future.
  • Implement DNS query logging and analysis at the resolver level. Tools like Zeek or commercial DNS analytics platforms can flag tunneling behavior through query length, entropy, and frequency baselining.
  • Restrict Google Apps Script execution at the organizational policy level. Disable execution for end users where business requirements don't justify it, and monitor script deployment IDs for unexpected rotation.
  • Hunt for HOLLOWGRAPH artifacts: Search for .NET NativeAOT-compiled DLLs with unknown provenance, and inspect text files containing JWT or OAuth token strings in user-writable directories.
  • Engage threat intelligence feeds covering Iranian APT infrastructure. The overlaps between Cavern Manticore, MuddyWater, and OilRig mean shared indicators may surface across multiple reporting sources.

The fundamental problem is architectural: when adversaries operate inside the same trusted services your business depends on, perimeter-based security models are structurally blind. The defense has to move to the data layer — monitoring what those services are being asked to do, not just where the traffic is going.