Kaspersky identified a new communication module for Project CAV3RN, a cyberespionage framework targeting Israel. The module uses .NET Native AOT and communicates by embedding commands and results in Outlook calendar events accessed through Microsoft Graph API, replacing prior HTTP/WebSocket methods. Communications are encrypted with RSA and AES-GCM. When authentication to Microsoft Graph fails, the module retrieves replacement configuration via DNS AAAA records from attacker-controlled nameservers. Infrastructure and behavioral indicators suggest a low-confidence attribution to OilRig (APT34), leveraging Microsoft-hosted services and compromised regional infrastructure for command and control.

This malware enables stealthy command and control communications through legitimate Microsoft services (Outlook calendar via Microsoft Graph API) and fallback DNS queries, potentially evading detection. It facilitates cyberespionage activities targeting Israeli entities. The use of strong encryption (RSA and AES-GCM) protects the confidentiality and integrity of commands and data exchanged. The fallback mechanism via DNS AAAA records increases resilience against disruption of primary communication channels.

No official patch or remediation is applicable as this is a malware framework rather than a software vulnerability. Defenders should monitor for indicators of compromise such as the listed domains and hashes. Awareness of this threat and its use of Microsoft Graph API and DNS for command and control can guide detection and response efforts. Since this is a targeted espionage tool, organizations in Israel and related sectors should apply enhanced monitoring of Outlook calendar events and DNS traffic for suspicious patterns. Patch status is not applicable; check vendor advisories and threat intelligence updates for detection signatures and mitigation strategies.