New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops

In a significant evolution of the Project CAV3RN tooling, a new .NET Native AOT communication module dubbed AzureCommunication.dll has been deployed to replace the framework’s earlier HTTP/WebSocket C2 component.

A stealthy channel that abuses Outlook calendar events over Microsoft Graph and a DNS-based recovery mechanism for Microsoft 365 credentials.

This shift reinforces CAV3RN’s positioning as a modular cyberespionage platform. It aligns it with a broader OilRig (APT34) trend of leveraging Microsoft‑hosted services as covert command-and-control transports.

Subsequent public work by Check Point in July 2026 confirmed this modular framework but did not yet cover the latest communication layer now analyzed.

The newly observed AzureCommunication.dll module preserves the same controller-facing interface, exposing a single export, QueryInterface, that accepts commands in the familiar get and send string format, including the legacy URL parameter retained solely for compatibility.

Functionally, however, it abandons HTTP/WebSocket in favor of Microsoft Graph-backed calendar operations, allowing CAV3RN operators to pivot their C2 into a fully cloud-hosted channel that blends with legitimate Microsoft 365 traffic.

AzureCommunication.dll ships with an embedded configuration object containing Microsoft Entra tenant identifiers, OAuth client credentials, a compromised Outlook mailbox.

A DNS bootstrap domain (cloudlanecdn[.]com), and RSA key pairs used to protect C2 traffic, which it serializes to a local logAzure.txt file when first executed.

Using the Azure Identity stack, the module obtains an OAuth token through the client credentials flow and validates its access by querying the organization endpoint at graph.microsoft.com before moving on to calendar operations.

Kaspersky’s June 2026 private reporting on Project CAV3RN described a controller-based architecture in which a dedicated WebSocket-capable DLL, n-HTCommp.dll, handled C2 while the controller (uxtheme.dll) issued and routed commands to plugins via a seven-character Agent ID.

The module then abuses the default calendar of the compromised mailbox as a dead-drop C2 channel, constraining all activity to a fixed one-hour window on 2050‑05‑13 (22:00–23:00 UTC) to keep events effectively invisible in normal views.

Operator-to-agent commands are stored as events whose subjects follow the format Event ID: <agent-id>, while heartbeat and result events use Boss update ID: <agent-id>1500 and Boss Report ID: <agent-id>1500 respectively, with 1500 acting as a fixed suffix rather than part of the Agent ID.

CAV3RN Module Replaces WebSocket C2

For inbound tasking, a get operation triggers a Microsoft Graph calendarView query, filtered by the agent-specific subject, followed by a pull of associated attachments and immediate event deletion once the tasking package has been retrieved.

Attachments named file0.txt carry operator-to-agent commands, which are split across multiple chunks and wrapped in a hybrid cryptosystem: a 256‑byte RSA‑OAEP‑SHA256 block transports a 32‑byte AES key, with the remainder of the payload protected via AES‑256‑GCM using a 12‑byte nonce and 16‑byte authentication tag.

After decrypting and authenticating the payload, the module returns the reconstructed JSON command such as a debug logging toggle encoded as cmd 003_;;,_ to the controller via QueryInterface for local dispatch to internal handlers or plugins.

For outbound results, a send operation reverses this process: the module generates a fresh AES‑256‑GCM key, encrypts the controller’s output, protects the key.

The configured RSA public key, and uploads the encrypted fragments as File0.txt, File1.txt, and so on, before renaming the event subject to Boss Report ID: <agent-id>1500 to signal completion.

Agent liveness is tracked through recurring heartbeat events identified by Boss update ID: <agent-id>1500, which the module refreshes by deleting any existing entry in the 2050 calendar window and creating a new placeholder event whose subject is later patched via Microsoft Graph.

Heartbeat events carry no attachments, minimizing their observable footprint while preserving an operator-visible signal that the implant is still active.learn.

When Microsoft Graph authentication or tenant validation fails, AzureCommunication.dll falls back to a DNS AAAA-based recovery protocol using cloudlanecdn[.]com.

A domain whose custom authoritative nameservers came online in May 2026 and are hosted under a single AS, indicating logically redundant but centrally controlled infrastructure.

The module uses AAAA responses as 16‑byte containers to first recover field lengths via .p. queries and then reconstruct TenantId, ClientId, ClientSecret, and UserEmail values via segmented .q. queries, encoding each agent’s ID as uppercase hexadecimal that is embedded in every recovery request.

The CAV3RN framework has previously been tentatively linked to OilRig (APT34), and this new module adds behavioral consistencies with documented OilRig tradecraft, including the use of Microsoft-hosted services for C2 (EWS, Office 365 drafts, Microsoft Graph).

While investigators report no direct code reuse or infrastructure overlap, the convergence of techniques strengthens a low-confidence association, particularly given the reuse of compromised regional Microsoft 365 mailboxes for high-value espionage targeting.

For defenders, this evolution underscores the need for deep telemetry and anomaly detection around Microsoft Graph access patterns, including calendar operations in far-future time windows, unexpected OAuth client IDs, and unusual attachment-heavy events in high-risk mailboxes.

Organizations should also monitor DNS traffic for structured AAAA queries to attacker-controlled domains like cloudlanecdn[.]com that carry encoded identifiers and offsets, as these may signal active configuration recovery attempts by cloud-centric C2 implants.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide