Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar (Microsoft Graph API) and DNS AAAA Records for C2 and Credential Recovery — Threadlinqs Intelligence
As of 2026-07-21, Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar (Microsoft Graph API) and DNS AAAA Records for C2 and Credential Recovery is a high-severity malware threat attributed to APT34 (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1588 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: APT34 · Iran · ESPIONAGE
Kaspersky GReAT identified AzureCommunication.dll, a new .NET Native AOT communication module for the modular Project CAV3RN cyberespionage framework, that exchanges commands and results via Outlook
Project CAV3RN (internally "Cav3rn"/"Cavern") is a modular cyberespionage framework that Kaspersky has tracked since December 2025 and that Check Point Research independently tracks under the name "Cavern Manticore." The framework evolved from a monolithic Cav3rn-era agent using steganographic PNG-based transport and a WebShell command handler into a controller-based architecture (observed by April 2026) built around a persistent controller component, uxtheme.dll (the "Cavern Agent"), which manages an Agent ID, a polling loop, and command routing, and which loads swappable native communication and post-exploitation plugin modules.
Initial access in the Cavern Manticore intrusions leverages abuse of the SysAid IT service-management software's update feature to deliver a DLL sideloading chain: a legitimate loader is abused to load the trojanized uxtheme.dll (Cavern Agent), which in turn loads the native communication module n-HTCommp.dll for HTTPS/WebSocket-based C2 connectivity. Deliberate compilation-format diversity across the .NET Framework (IL-only, symbol-rich), Mixed-Mode C++/CLI, and .NET 8 Native AOT (fully native, metadata-stripped) forms is used as an explicit anti-analysis strategy, forcing defenders to switch reverse-engineering toolchains between modules; per-module AppDomain isolation further limits in-memory artifact recovery, and NativeAOT runtime descriptors hide P/Invoke API imports from standard import-table analysis.
The most recent and most novel module, AzureCommunication.dll, replaces the legacy n-HTCommp.dll HTTP/WebSocket channel with a covert channel built entirely on legitimate Microsoft 365 services. Compiled with .NET Native AOT (single exported function QueryInterface, accepting a null-terminated UTF-16 command string in the form get_;;_<agent-id>_,_<legacy-url> or send_;;_<agent-id>_,_<legacy-url>_,_<result>), the module stores its configuration in a file named logAzure.txt containing a hardcoded Microsoft Entra tenant ID, application (client) credentials, the target mailbox address, a DNS bootstrap hostname, and an embedded RSA key pair. Using the Microsoft Graph API against a compromised Israeli law-firm Microsoft 365 mailbox, the module creates and reads calendar events that function as an asynchronous C2 dead-drop: all events are scheduled inside a single fixed one-hour window (2050-05-13 22:00-23:00 UTC) far in the future so they never surface in a normal calendar view. Event subjects encode message type and agent identity: "Event ID: <agent-id>" carries operator-to-agent commands, "Boss update ID: <agent-id>1500" is an agent heartbeat, and "Boss Report ID: <agent-id>1500" carries agent-to-operator results. Command payloads embedded in event bodies are protected with RSA-OAEP-SHA256 (256-byte key-transport block) wrapping an AES-256-GCM-encrypted body; the implant decrypts using its embedded RSA private key and re-encrypts results before writing its own calendar event.
When Microsoft Graph authentication fails (e.g., revoked application credentials or blocked tenant), AzureCommunication.dll falls back to a DNS AAAA-based configuration-recovery channel against the actor-registered domain cloudlanecdn[.]com (registered 2025-12-24; delegated to dedicated nameservers ns1-ns4.cloudlanecdn[.]com on 2026-05-02). Agent IDs are converted to uppercase hexadecimal (e.g., SFmLgQZ -> 53466D4C67515A) and embedded into subdomain labels. A length query of the form d.<hex-agent-id>.<field-index>.p.<host> returns the size of a requested configuration field (TenantId, ClientId, ClientSecret, or UserEmail) encoded in bytes 2-3 of the returned AAAA (IPv6) address; the module then issues sequential data queries of the form d.<hex-agent-id>.<field-index>.<offset>.q.<host>, each returning a 14-byte chunk of the field value embedded in the AAAA response bytes, until the full value is reassembled. A sentinel response of 2001:4998:44:3507::8000 signals that no data is currently available for that query, allowing the
Target sectors: legal services, human resources, government administration, itservices, defense
Target regions: israel, Middle East
References
- Project CAV3RN: cyberespionage framework using Outlook and DNS
- Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
- Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
- OilRig, COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452, Group G0049
- DNS Tunneling in the Wild: Overview of OilRig's DNS Tunneling
- OilRig (Threat Actor)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1199, T1569.002, T1574.002, T1547.013, T1574.002, T1027, T1027.004, T1140, T1027.003, T1555.004