Cavern C2 Framework Iran
Cybersecurity researchers have found that the Cavern command and control framework set continues to evolve. The toolkit is used by Iranian nation-state hackers to launch cyber-attacks on Israel.
Kaspersky, a Russian cybersecurity company, has been monitoring the cluster of threats from December 2025. The company’s continued investigation has enabled them to discover some unreported components that expand the toolkit's communication capabilities.
The Cavern C2 framework Iran has become increasingly sophisticated. It leverages legitimate services like Google Apps Script and Microsoft 365 calendars for its activities, thus making it even harder to detect.
Let us discuss Cavern C2 Framework of Iran, its latest developments, and what it means for targeted organizations.
Important Characteristics of the Cavern C2 Framework
- The Cavern is a modular C2 framework used by Iranian hackers
- Has Israel as the target
- Employs Google Apps Script and Microsoft 365 calendars as stealthy C2 channels
- Has a component known as HOLLOWGRAPH which exploits Outlook calendars
- Linked to Iran's Ministry of Intelligence and Security
- Additionally linked to MuddyWater and OilRig
What Is the Cavern C2 Framework?
The Cavern C2 framework Iran was first publicly documented by Check Point Research in early July 2026. It is comprised of various modules which collectively provide post exploitation capabilities with minimal forensics trace.
The Modules:
- File operations
- SQL database enumeration
- Active Directory reconnaissance
- LDAP brute-force attacks
- Network reconnaissance
- SOCKS5 proxy and WebSocket tunneling
The Attribution:
The use of Cavern C2 has been linked to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security. The group shares overlaps with MuddyWater and an OilRig sub-group known as Lyceum.
The HOLLOWGRAPH Module
Two back-to-back reports from Group-IB and Kaspersky detailed a module called HOLLOWGRAPH. This module turns Microsoft 365 calendars into covert C2 channels.
How HOLLOWGRAPH Works:
- Abuses the Microsoft Graph API
- Uses Microsoft 365 calendar events as a two-way dead-drop
- Operators plant tasking as calendar events
- The implant exfiltrates stolen files by creating its own events
- Encrypted data is attached as files to the events
The Evasion Technique:
To avoid catching the mailbox owner's attention, every event is dated far into the future. The date is set to May 13, 2050. Payloads are attached as files to the event.
DNS Tunneling:
- HOLLOWGRAPH also employs DNS tunneling. This updates the credentials of Microsoft Entra ID for authentication on Graph API. The updated values are written to a text file on disk.
- The Cavern C2 framework Iran has shown a clear preference for abusing legitimate services. This allows its traffic to blend in with normal network activity.
The New Google Apps Script Relay
Kaspersky discovered a new communication module called GoogleService.dll. This module adds another layer of evasion to the Cavern C2 framework Iran.
How It Works:
- Reads a configuration file from disk (conf.json)
- Does a DNS A-record lookup
- Decides to either go for HTTPS directly or route through Google Apps Script
- Different transactions may use different methods
Upon Google Mode Selection:
- The module sends its request to the Apps Script deployment
- The Apps Script sends the request to the threat actor-controlled backend
If the “Direct HTTPS” Option Is Selected:
- It connects directly to the configured URL
- There is no relaying involved
The dual-mode approach provides the attackers with flexibility because they can use whichever method is most suitable for the network.
The rnp.dll Broker
Kaspersky also discovered an inter-component broker called "rnp.dll." This component is the local bridge for the framework.
Its Function:
- Discover and load DLL components
- Route messages between components
- Facilitate upgrades during run time
- The modularity of the Cavern C2 framework Iran increases its flexibility and robustness.
Re-registered Domain
- The primary domain that relates to the above activities is “studiotikva[.]com.” It was first registered in February 2024. The domain expired in February 2026. It was re-registered three months later.
- This suggests the attackers are maintaining their infrastructure. They are ensuring they have a reliable C2 channel.
The OilRig Connection
Kaspersky has linked the Cavern C2 framework Iran to OilRig with low confidence. The link is based on several indicators:
- Use of Microsoft-hosted services for C2
- Presence of secondary recovery mechanisms for OAuth refresh tokens
- Use of compromised infrastructure belonging to entities in target regions
- There is no direct code reuse or infrastructure overlap. But the similarities in technique are notable.
APT42 and TAMECAT
The Cavern C2 framework Iran disclosure comes as DarkAtlas detailed APT42's use of TAMECAT.
TAMECAT Capabilities:
- Enumeration
- Discovery
- Arbitrary command execution
- Browser credential and cookie collection
- Outlook .ost mailbox collection
- Screenshot capture
- Fallback C2 and exfiltration mechanisms
Targeting:
APT42 used spear-phishing attacks targeting individuals associated with the nuclear energy sector. These attacks took place in April and May 2026. Initially, the lure used were LNK files disguised as PDF files.
Social Engineering:
The social-engineering theme used podcast and interview invitations. This is consistent with the preference of this group for building their professional image before releasing any malware.
Acceleration Through AI:
Generative AI was also used by the Iranian hackers to accelerate their work. This includes:
- Developing specialized tooling
- Researching exploitation techniques
- Language translation
- Identifying official email addresses
- Investigating entities of interest
DarkAtlas noted: "APT42 remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed."
The Evolution of Cavern
The Cavern C2 framework Iran has shifted to a modular, extensible architecture. This shift is assessed to have taken place in late April 2026.
Why This Matters:
- Modular design makes detection harder
- New plugins can be added easily
- The framework can adapt to new targets
- Legitimate services are used to hide traffic
Kaspersky's Assessment:
"By abusing legitimate services - previously Outlook calendar events and now Google Apps Script - the framework blends its C2 traffic with normal network activity, complicating network-based detection. Given its development pace, modular design, and operational tempo, we assess that Cav3rn will likely continue to expand."
Implications for the Defender
The Cavern C2 framework Iran is a complex threat:
The Threat:
- C2 via the use of legitimate services by attackers
- Traffic is indistinguishable from regular traffic
- Modularity is complex to detect
- Can easily release new modules
The Response:
- Monitor for unusual use of Microsoft 365 calendars
- Watch for DNS tunneling activity
- Look for suspicious Google Apps Script usage
- Investigate unexplained outbound connections
Conclusion
The Cavern C2 framework Iran has changed a lot. The C2 traffic of Iranian hackers is hidden with Google Apps Script and Microsoft 365 calendars.
Main facts to remember:
- Cavern is a modular C2 framework created by Iranian hackers
- Targets entities located in Israel
- Uses Google Apps Script and Outlook calendars to conceal C2
- HOLLOWGRAPH exploits Microsoft Graph API
- Associated with Iran's Ministry of Intelligence and Security
- APT42 operates with TAMECAT
Defenders should monitor for unusual use of legitimate services. Look out for any kind of DNS tunneling and unusual calendar activity.
Cavern C2 Command and Control Framework Used by Iran is an example of attackers taking advantage of legitimate services. Stay vigilant.
FAQ Section
What is the Cavern C2 framework Iran?
It is a modular C2 framework used by Iranian nation-state hackers. It specifically focuses on targeting in Israel and uses reliable platforms like Google Apps Script and Microsoft 365 calendars for obfuscation purposes.
What is HOLLOWGRAPH?
HOLLOWGRAPH is a module that abuses Microsoft 365 calendars as covert C2 channels. It employs Microsoft Graph API for file exfiltration and receiving commands through calendar events.
How does the Google Apps Script relay work?
The malware makes a DNS A-record query for deciding whether the connection is going to be established directly using HTTPS or through the Google Apps Script relay.
What is APT42 doing?
APT42 is using TAMECAT in spear-phishing attacks targeting the nuclear energy sector. The group uses podcast and interview invitations as lures and is accelerating operations with generative AI.
What should organizations do?
Monitor for unusual use of Microsoft 365 calendars and DNS tunneling. Watch for suspicious Google Apps Script usage. Investigate unexplained outbound connections.
