Full Report
Project CAV3RN targets Israel with Google Apps Script C2 relays and DNS-based routing. Modular .NET NativeAOT framework blends C2 traffic with legitimate Google services to evade detection.
Analysis Summary
# Threat Actor: Project CAV3RN
## Attribution & Identity
* **Identification:** The activity is currently tracked as **Project CAV3RN**.
* **Aliases:** None explicitly listed in the provided summary, though the actor operates with high technical proficiency.
* **Known Associations:** The campaign specifically targets Israeli interests, suggesting a geographic or political alignment often associated with regional regional Middle Eastern tensions, though specific attribution to a known state-sponsored group is not confirmed in the text.
## Activity Summary
Project CAV3RN is an ongoing cyber-espionage campaign characterized by the use of highly modular and evasive malware. Recent operations involve the deployment of a .NET NativeAOT framework designed to facilitate command-and-control (C2) communications through legitimate cloud ecosystems. The actor is notable for its persistence and ability to adapt its infrastructure to bypass traditional security perimeters.
## Tactics, Techniques & Procedures
* **C2 Relay via Legitimate Services:** Utilizing Google Apps Script (GAS) to act as a relay for C2 traffic, making malicious communication appear as legitimate traffic to `script.google[.]com`.
* **DNS-Based Routing:** Implementing DNS-based mechanisms to route traffic and identify target environments.
* **NativeAOT Compilation:** Using .NET NativeAOT to compile binaries into machine code, which complicates reverse engineering and bypasses signature-based detection that targets standard .NET managed code.
* **Evasion via Cloud Blending:** Blending C2 traffic with legitimate Google services (Workspace/Drive API patterns) to evade network traffic analysis.
* **MITRE ATT&CK Mapping (Inferred from context):**
* T1071.004 - Application Layer Protocol: DNS
* T1102.002 - Web Service: Bidirectional Communication (Google Apps Script)
* T1027 - Obfuscated Files or Information (NativeAOT compilation)
## Targeting
* **Sectors:** Likely Government, Defense, and critical Infrastructure (consistent with regional espionage patterns).
* **Geography:** Primarily **Israel**.
* **Victims:** Specific organizations were not named, but the focus remains on high-value Israeli targets.
## Tools & Infrastructure
* **Malware Families:** A modular **.NET NativeAOT framework** (custom-built for Project CAV3RN).
* **Infrastructure:**
* **C2 Relays:** Google Apps Script URLs (e.g., `script.google[.]com/macros/s/[Redacted]/exec`).
* **DNS Infrastructure:** Used for initial routing and victim validation.
* **Defanged Domains:** `script.google[.]com`, `googleapi[.]com`.
## Implications
Project CAV3RN represents a sophisticated shift in regional threat dynamics. By utilizing "Living off the Cloud" techniques—specifically Google Apps Script—the actor significantly reduces the efficacy of IP-based blocking and domain reputation services. The use of NativeAOT suggests a developer-centric approach aimed at long-term persistence and the evasion of automated sandbox analysis.
## Mitigations
* **Cloud Traffic Monitoring:** Implement deep packet inspection (DPI) to scrutinize traffic to `script.google[.]com`. Look for unusual URI patterns or high-frequency POST requests that do not align with known business processes.
* **DNS Security:** Monitor for unusual DNS query volumes or patterns (e.g., subdomains used for data exfiltration or routing) and implement DNS filtering.
* **Endpoint Detection:** Deploy EDR solutions capable of monitoring memory for unmanaged code execution, as NativeAOT binaries may not trigger standard .NET hooks.
* **API Access Control:** Restrict the use of Google Apps Script within the corporate environment to authorized users and projects only.