Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the

Report facts: The article describes the evolution of the Cavern (Cav3rn) command-and-control framework used by Iranian nation-state actors, leveraging DNS and Google Apps Script to better blend C2 traffic into what appears to be legitimate network activity targeting Israeli entities. RealGround analysis: While the report is focused on traditional cyber C2 infrastructure rather than AI systems, the same evasion and living-off-the-land techniques can be adapted to hide malicious AI-agent orchestration or data exfiltration via seemingly benign cloud services. Organizations should treat this as a signal to continuously red-team AI-enabled workflows for covert command channels and abuse of SaaS and cloud scripting platforms that could be used to control or manipulate AI agents without detection.