Project CAV3RN, a cyberespionage framework attributed to OilRig (APT34) with low confidence, has introduced a new .NET Native AOT communication module (AzureCommunication.dll) that abuses Microsoft Graph API to exchange C2 commands and results through Outlook calendar events scheduled in 2050. The module authenticates to Microsoft Entra ID using hardcoded application credentials and a compromised Israeli law firm's mailbox. When Graph authentication fails, it falls back to a novel DNS AAAA-based recovery mechanism using cloudlanecdn.com, where IPv6 address bytes encode replacement configuration values (TenantId, ClientId, ClientSecret, UserEmail) in 14-byte fragments. All command and result data is protected with RSA-OAEP-SHA256 and AES-256-GCM encryption.
DNS AAAA exfiltration
1 post
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery