Project CAV3RN Uses Google Apps Script as a Rotating C2 Relay and DNS‑Based Channel Selector
What Happened – Kaspersky’s SecureList details a new module in the CAV3RN espionage framework that selects its command‑and‑control (C2) path via DNS A‑record responses. The chosen path can be either a direct HTTPS endpoint or a Google Apps Script relay that the attacker can rotate on‑the‑fly. The framework also includes a local DLL broker that loads additional components at runtime.
Why It Matters for Compliance & Audit Readiness
- The use of a legitimate cloud service (Google Apps Script) as a covert relay illustrates how mis‑configured or unmonitored third‑party services can become a stealthy C2 channel, a scenario SOC 2 control CC6.1 (System and Communications Protection) is designed to detect and log.
- Continuous evidence collection on outbound traffic to cloud‑hosted scripts helps prove that your organization maintains an auditable “defense‑in‑depth” posture, satisfying the SOC 2 “Monitoring of Security Controls” requirement.
- Mapping this mis‑use to a control‑gap in your Cloud Host vendor‑risk program provides concrete audit evidence for the “Vendor Management” criteria (CC1.2).
Who Is Affected – Government agencies, critical‑infrastructure operators, and any organization that permits unsanctioned Google Apps Script execution from corporate endpoints (GOV_PUBLIC, TECH_SAAS).
Recommended Actions
- Inventory all authorized Google Workspace scripts and enforce a whitelist; any unknown script should trigger an alert.
- Enable DNS‑query logging and correlate A‑record responses with known malicious domains.
- Map the “unauthorized cloud‑service usage” gap to SOC 2 CC6.1 and collect continuous logs as audit evidence.
Source: SecureList – Project CAV3RN continues
Technical Notes – The C2 module is a 64‑bit .NET 8 NativeAOT DLL (GoogleService.dll) that uses DNS A‑records to toggle between direct HTTPS and a Google Apps Script relay. No CVE is disclosed; the threat lies in the abuse of a legitimate third‑party platform. Source: same as above