Two vendors have published on the same espionage framework within weeks. Kaspersky, which calls it Project CAV3RN and says it has tracked the cluster since December 2025, described a new communication module on 11 August that picks between direct HTTPS and a Google Apps Script relay. Group-IB’s 20 July report covers HOLLOWGRAPH, a component it links to the Cavern framework with high confidence, that hides command traffic in Microsoft 365 calendar events. Who is behind it is unsettled: Group-IB says the actor “remains unknown at this time.”
Attribution: What the Sources Say
The Hacker News, which brought the two reports together on 17 August, says Cavern is “linked to Cavern Manticore, a hacking group affiliated with Iran’s Ministry of Intelligence and Security” but names no assessor, so we treat the actor label and the government-affiliation claim as unconfirmed. Group-IB’s own report notes “tradecraft similarities with Iranian-nexus activity” and says Cavern’s modular backdoor closely resembles a .NET backdoor used by Lyceum in early 2025, and assesses “a potential link to Lyceum with low confidence.” Kaspersky wrote in its 21 July report that it retains “our low-confidence assessment that Project CAV3RN is associated with OilRig” and found “no direct code reuse or infrastructure overlap.” These are the only actor-level assessments from the two researchers, and both are low confidence. Both vendors describe focused targeting of Israeli entities: Kaspersky says the framework is used against targets in Israel, and Group-IB found 12 victims carrying the implant, about three of them actively communicating, with Israeli indicators suggesting “a focused interest in Israeli entities.”
Kaspersky: A DNS-Directed Relay Choice
Kaspersky’s 11 August report describes GoogleService.dll, a module that reads a configuration file and uses a DNS A-record lookup to choose, per transaction, between a direct HTTPS command URL and a Google Apps Script relay. If the DNS response selects the Google channel, requests go through an Apps Script deployment that forwards them to the operator’s backend; otherwise the module contacts the configured address directly. Kaspersky’s configuration excerpt includes a direct C2 URL, a DNS domain and an Apps Script deployment ID. The same DNS channel can replace the relay deployment ID, which lets the operator rotate the Google channel. Kaspersky’s earlier 21 July report had documented a module using Outlook calendar events; the Google relay is the newer addition.
Kaspersky also documents rnp.dll, a broker that loads components and routes messages between them. Per Kaspersky, updates require a higher-version DLL under a new path.
Group-IB: HOLLOWGRAPH
Group-IB describes HOLLOWGRAPH as one component of a larger toolkit: a .NET NativeAOT implant that uses a compromised Microsoft 365 account and mailbox through the Microsoft Graph API. Operators plant tasking as calendar events, and the implant replies with encrypted data in events it creates; events are dated 13 May 2050. The implant also refreshes the Microsoft Entra ID (Azure AD) credentials it authenticates with, using IPv6 AAAA DNS queries. Group-IB gives the earliest observed communication as 3 June 2026 and says the malware has been in use since at least early June.
What This Means
Group-IB says the malware conceals its command traffic within legitimate Microsoft 365 and network traffic, “evading conventional perimeter defenses.” The points below are our assessment, not the vendors’ findings:
- Calendar-level audit logging is probably the most direct way to see this traffic, because it looks like ordinary Graph API use at the network layer.
- The per-transaction DNS choice means blocking script.google.com alone may push traffic to the direct HTTPS path, so defenders should watch both.
- Reported victims are concentrated in Israel; organisations elsewhere should read this as a technique to detect rather than as evidence of local targeting.
Recommended Actions
These are our recommendations, not measures either vendor prescribes.
- Audit Microsoft 365 calendar sharing permissions and review audit logs for unusual calendar creation or Graph API calls from unfamiliar service principals.
- For HOLLOWGRAPH, hunt for unusual AAAA query patterns to unfamiliar domains. Group-IB’s report describes the DNS mechanism; check its indicators before building detections.
- For GoogleService.dll-style behaviour, review outbound connections to script.google.com that do not match your users’ normal use, alongside periodic DNS A-record lookups to unfamiliar domains.
- Pull the indicators directly from the Kaspersky and Group-IB reports rather than from secondary summaries.