Full Report
Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.
Analysis Summary
# Tool/Technique: Project CAV3ERN (C2 Module)
## Overview
Project CAV3ERN is a sophisticated cyberespionage framework discovered by Kaspersky GReAT. Its primary innovation lies in its Command and Control (C2) mechanism, which utilizes the Microsoft Graph API to communicate through an Outlook calendar. It also incorporates a secondary, covert backup channel that leverages DNS AAAA record responses for data exfiltration and command reception.
## Technical Details
- **Type:** Cyberespionage Framework / Malware
- **Platform:** Windows
- **Capabilities:** Covert C2 communication via cloud services, backup DNS tunneling, modular architecture, and persistence.
- **First Seen:** Publicly documented by Kaspersky in late 2024/early 2025 (Project active through 2024).
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1102.002 - Web Service: Bidirectional Communication]** (Using Microsoft Graph/Outlook Calendar)
- **[T1071.004 - Application Layer Protocol: DNS]** (DNS AAAA records for backup C2)
- **[T1568.002 - Dynamic Resolution: Domain Generation Algorithms]** (Used for DNS-based fallback)
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]**
## Functionality
### Core Capabilities
- **Outlook Calendar C2:** The module leverages the Microsoft Graph API to read and write to the Outlook calendar of a compromised or attacker-controlled account. Commands are hidden within calendar event descriptions or metadata, allowing the traffic to blend in with legitimate Microsoft 365 cloud traffic.
- **Data Exfiltration:** Capable of staging and uploading stolen data through the same cloud-based channels to avoid detection by traditional network security perimeters.
### Advanced Features
- **DNS AAAA Fallback:** If the primary Microsoft Graph connection is interrupted, the malware switches to a DNS-based channel. It sends DNS queries for specific subdomains and parses the **AAAA (IPv6)** responses. The 128-bit IPv6 addresses are treated as data payloads containing further instructions or small configuration updates.
- **Modular Design:** The module is part of a larger framework (CAV3ERN) designed for long-term persistence and espionage activities.
## Indicators of Compromise
*Note: Specific hashes and domains vary by campaign. Based on the Kaspersky GReAT report summary:*
- **Network Indicators:**
- `graph.microsoft[.]com` (Legitimate site used maliciously)
- `login.microsoftonline[.]com` (Used for authentication to Graph API)
- Diversified DGA-generated subdomains for DNS tunneling (e.g., `<unique_id>.tunnel[.]example[.]com`)
- **Behavioral Indicators:**
- Unexpected processes (like `svchost.exe` injections or standalone binaries) making frequent requests to Microsoft Graph APIs.
- High volume of DNS queries for AAAA records to uncommon or newly registered domains.
## Associated Threat Actors
- **To be determined:** Currently tracked under the moniker **Project CAV3ERN**. The level of sophistication and target selection suggests a state-sponsored or highly advanced APT group focused on cyberespionage.
## Detection Methods
- **Signature-based detection:** Scanning for binaries containing strings related to Microsoft Graph API scopes (e.g., `Calendars.ReadWrite`) combined with custom encryption routines.
- **Behavioral detection:** Monitoring for unusual calendar activity via Graph API calls from non-standard applications.
- **Network Analysis:** Detecting anomalous DNS patterns, specifically a high frequency of AAAA record lookups where the returned "IPv6 addresses" do not correspond to valid global routable addresses or show high entropy.
## Mitigation Strategies
- **Identity Management:** Implement strict Conditional Access policies for Microsoft 365, limiting which applications can call the Microsoft Graph API.
- **Monitor API Permissions:** Regularly audit Azure AD / Entra ID enterprise applications and service principals for excessive permissions (specifically `Calendars.ReadWrite`).
- **DNS Filtering:** Use protective DNS (PDNS) services to block lookups to known DGA domains and monitor for DNS tunneling signatures.
- **Endpoint Security:** Deploy EDR solutions to monitor for process injection and suspicious network calls originating from system processes.
## Related Tools/Techniques
- **Graphican / Graphite:** Other malware families known to use Microsoft Graph (OneDrive/Teams) for C2.
- **DNS Tunneling:** Similar to techniques used by OILRIG (APT34) but specifically utilizing the AAAA record type for payload delivery.