Project CAV3RN Modular Espionage Framework

Project CAV3RN is a modular espionage framework discovered targeting organizations in Israel. Recent analysis has uncovered advanced orchestration capabilities within the framework's communication module, 'GoogleService.dll', which is compiled with .NET 8 NativeAOT. This framework employs a sophisticated C2 strategy where the malware queries an adversary-controlled domain to receive DNS A-record responses. These responses dictate the communication channel, allowing the attacker to toggle between direct HTTPS connectivity and a Google Apps Script relay. The infrastructure also allows the threat actor to remotely validate and rotate Google Apps Script deployment IDs, ensuring resilient communication and evasion of static infrastructure blocks. The framework relies on a local broker that manages DLL loading, system inventory collection, and runtime upgrades, facilitating long-term persistence and modular capability expansion.

Attack Chain

1. The local broker initializes and registers the communication module 'GoogleService.dll'.
2. The module performs an internal handshake with the broker to verify identity using a fixed GUID.
3. The malware performs a DNS A-record query to 'studiotikva.com' to receive instructions on the preferred communication channel.
4. Depending on the DNS response (specifically the fourth octet), the module selects either a direct HTTPS endpoint or a Google Apps Script relay.
5. The module performs a deployment ID freshness check using further DNS queries to ensure the current Google Apps Script relay is valid.
6. The communication module executes internal commands such as 's_version' to inventory local DLLs or 's_write' to drop payloads to disk.
7. Data is serialized, XORed with 0xAC, Base64-encoded, and exfiltrated over the selected transport layer.

Impact

Project CAV3RN is used in targeted espionage operations against entities in Israel. The framework's modular nature allows for customized payload delivery, system discovery, and persistent access, potentially leading to significant intellectual property theft and unauthorized information access within compromised environments.

Recommendation

• Deploy network-level blocking for the C2 domain 'studiotikva.com' and monitor for suspicious DNS queries targeting this domain.
• Implement strict Egress filtering for traffic directed towards 'script.google.com' if not required for business operations, and monitor for unusual 'Google Apps Script' deployment usage.
• Enable process creation logging (Event ID 1) to detect suspicious DLL loading or execution patterns by unknown binaries in user-writable directories (e.g., AppContext.BaseDirectory).
• Monitor for anomalous DNS A-record traffic where the queried domain ends in '.m.studiotikva.com' or '.p.studiotikva.com'.