Cybersecurity researchers have uncovered a sophisticated command-and-control module that lets Iranian state-backed hackers switch between direct HTTPS connections and Google Apps Script relays for each transaction, using DNS responses to choose the method. Russian security firm Kaspersky disclosed the findings as part of its ongoing monitoring of the Cavern framework, a toolkit used by hackers linked to Iran's Ministry of Intelligence and Security in attacks against Israeli entities. The discovery expands the known capabilities of Cavern, which was first publicly documented by Check Point Research in early July 2026.
The newly identified communication module, called GoogleService.dll, reads a configuration file from disk and performs a DNS A-record query to select either direct HTTPS or a Google Apps Script relay for each individual transaction, according to Kaspersky. When Google mode is selected, the module sends requests to the Apps Script deployment, which then forwards them to the attacker-controlled backend. The same DNS infrastructure can validate and replace the relay deployment ID, allowing operators to rotate the Google channel. Researchers also discovered an inter-component broker called rnp.dll that functions as the framework's local bridge, discovering and loading DLL components, routing messages between them, and supporting runtime upgrades. The primary domain linked to the activity, studiotikva[.]com, was first registered in February 2024, expired in February 2026, and was re-registered three months later.
Kaspersky's analysis found that Cavern consists of multiple components, including an Agent and an assortment of modules, that work together to enable mission-specific post-exploitation functionality while minimizing forensic visibility and ensuring persistent access. The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling. The firm has linked Cavern's use to a hacking group affiliated with Iran's Ministry of Intelligence and Security that shares overlaps with MuddyWater and an OilRig sub-group known as Lyceum. Previous reports from Group-IB and Kaspersky detailed another module called HOLLOWGRAPH that turns Microsoft 365 calendars into covert command channels, abusing the Microsoft Graph API to exfiltrate files and receive commands using calendar events dated to May 13, 2050, to avoid catching the mailbox owner's attention. The malware, a .NET NativeAOT-compiled DLL, was first detected in the wild on June 7, 2026.
"By abusing legitimate services — previously Outlook calendar events and now Google Apps Script — the framework blends its C2 traffic with normal network activity, complicating network-based detection," Kaspersky stated. Cavern's shift to a modular, extensible architecture using a plugin-based system is assessed to have taken place in late April 2026. Kaspersky has linked it to OilRig (also known as APT34) with low confidence, citing the use of Microsoft-hosted services for command-and-control, the presence of secondary recovery mechanisms to obtain replacement OAuth refresh tokens, and the use of compromised infrastructure belonging to entities in regions it targets. The firm assessed that the Cavern framework will likely continue to expand, given its development pace, modular design, and operational tempo. The disclosure also revealed that another Iranian group, APT42, has been using a modular surveillance framework called TAMECAT in spear-phishing attacks targeting individuals in the nuclear energy sector as recently as April and May 2026, with social-engineering themes using podcast and interview invitations. Organizations facing persistent threats from state-sponsored actors will need to balance investing in behavior-based detection against the operational cost of monitoring legitimate cloud services that can double as covert channels.