Project CAV3RN is a sophisticated modular espionage framework targeting Israeli entities. It features advanced C2 capabilities that dynamically select between direct HTTPS and Google Apps Script relay channels based on DNS A-record responses. The framework uses DNS infrastructure to validate and rotate Google Apps Script deployment IDs, enabling stealthy communication. A local broker component manages DLL modules, inter-component messaging, and runtime upgrades. The communication module supports both direct C2 contact and an Apps Script relay forwarding requests to actor-controlled infrastructure. This approach leverages legitimate cloud services to evade detection and maintain operational flexibility.

The framework enables persistent espionage operations with stealthy and flexible command and control channels, complicating detection by abusing legitimate services such as Google Apps Script. This can lead to unauthorized data access and exfiltration from targeted Israeli entities. The modular architecture allows runtime upgrades and dynamic communication channel selection, increasing the threat's adaptability and resilience.

No official patch or remediation is available as this is a malware framework rather than a software vulnerability. Defenders should monitor for indicators of compromise such as the provided IP addresses, domains, URLs, and file hashes associated with Project CAV3RN. Network defenders should be aware of DNS-based C2 techniques and abuse of Google Apps Script for relay communications. Employing threat intelligence feeds and endpoint detection for the identified DLL components and network indicators can aid in detection and response.