CAV3RN shifts command traffic into Outlook calendars

Project CAV3RN has adopted a new communication module that hides command-and-control traffic inside Outlook calendar events, marking a significant upgrade to the cyberespionage framework’s efforts to evade conventional network monitoring.

The module, named AzureCommunication. dll, appears designed to replace an earlier component that exchanged instructions and stolen data through HTTP and WebSocket connections. It instead uses Microsoft Graph to access a compromised Microsoft 365 mailbox, turning calendar entries and their attachments into concealed communication points between operators and infected systems.

Researchers have tracked the CAV3RN activity cluster since December 2025, primarily in operations targeting organisations in Israel. The framework underwent a major redesign in April, shifting from separate downloader, executor and uploader components to a controller-led architecture with dedicated communication and post-exploitation plugins.

AzureCommunication. dll retains the interface used by the previous communication component, allowing it to receive commands from CAV3RN’s controller and return execution results. However, the destination and access credentials are obtained from the module’s own Microsoft Graph configuration rather than a web address supplied by the controller.

The software is compiled using. NET Native Ahead-of-Time technology, which converts managed code into native machine instructions. This removes much of the metadata normally available to malware analysts and makes reverse engineering more difficult.

A hardcoded configuration inside the module includes a Microsoft Entra tenant identifier, application credentials, the target mailbox, cryptographic keys and a domain used as a secondary recovery channel. The information can also be written to a local file called logAzure. txt, potentially creating a forensic trace on compromised systems.

After launching, the module requests an OAuth application token through Microsoft’s identity platform. It then checks the Microsoft 365 tenant’s organisation record to confirm that the credentials and permissions remain valid.

Successful authentication gives the malware access to the default Outlook calendar of the configured mailbox. Commands, system check-ins and operation results are stored within a fixed one-hour calendar window dated May 13, 2050.

Placing events more than two decades into the future reduces the likelihood that ordinary users will notice them in standard calendar views. Event subjects contain the infected machine’s seven-character agent identifier and labels that distinguish commands, heartbeat signals and completed reports.

Operator instructions are delivered through events whose subjects begin with “Event ID”. The module searches the designated 2050 time window, downloads attached command data and deletes the calendar entry after processing it.

Execution results are encrypted, divided into fragments and uploaded as sequential text-file attachments. Once the upload is complete, the event subject is changed to identify it as a report from the affected agent.

The encryption design combines asymmetric and symmetric cryptography. An AES key protects the command output, while RSA encryption secures the AES key. AES-GCM provides both confidentiality and integrity checks, making intercepted attachments difficult to read or alter without the operator’s private key.

CAV3RN also generates heartbeat events to show that an infected system remains active. The module deletes the previous heartbeat before creating a replacement, preventing large numbers of check-in entries from accumulating in the mailbox.

Abusing Outlook and Microsoft Graph offers attackers several operational advantages. Traffic to Microsoft services is common in corporate networks, and blocking the platform outright could interrupt legitimate email, calendar and collaboration functions. Cloud-hosted command channels may therefore blend more easily into normal activity than connections to unfamiliar internet servers.

The technique also shifts part of the attacker infrastructure into a trusted software ecosystem. Security teams monitoring only suspicious domains, unusual ports or direct command-server connections may fail to identify malicious Graph requests unless they also inspect cloud audit logs, application permissions and abnormal mailbox activity.

AzureCommunication. dll includes a DNS-based recovery system for cases where Microsoft Graph authentication or tenant validation fails. The mechanism sends specially structured queries to authoritative name servers and reconstructs replacement configuration values from IPv6-formatted AAAA responses.

The recovered fields include the tenant ID, client ID, client secret and mailbox address. Once all four values are rebuilt, the malware updates its local configuration and attempts to reconnect to Microsoft Graph.

The bootstrap domain, cloudlanecdn. com, was registered in December 2025. Its DNS configuration moved to custom name servers in May, aligning with the development period of the calendar-based module. Several nominally separate name servers shared the same underlying addresses, limiting the true redundancy of the infrastructure.

The framework has been linked with low confidence to OilRig, also known as APT34, a cyberespionage group associated with Iran. The assessment is based on behavioural similarities rather than direct code reuse or confirmed infrastructure overlap.

OilRig-linked tools have previously used email messages, Office 365 drafts, Microsoft Graph and cloud-storage services for command traffic. Other malware associated with the group has relied on secondary channels to restore expired or blocked cloud credentials.