Project CAV3RN Uses DNS to Switch Between HTTPS and Google Apps Script C2
Summary
Analysis of Project CAV3RN, observed targeting Israel, details GoogleService.dll and rnp.dll, DNS-based selection between direct HTTPS and a Google Apps Script relay, and brokered module loading and upgrades.
Key points
- The report documents GoogleService.dll, a 64-bit .NET 8 NativeAOT communication module, and rnp.dll, a local broker that coordinates framework components.
- DNS A-record responses select direct HTTPS or Google Apps Script for each C2 transaction; DNS queries can also retrieve a replacement relay deployment ID.
- GoogleService.dll reports DLL inventory and handles tasks. Its internal commands include configuration changes, diagnostic logging, and writing received data to files.
- The module XORs data with 0xAC and Base64-encodes it; direct C2 requests require an X-Client-Id header.
- The broker scans for DLLs every second, loads the highest-version matching components, routes messages, and supports runtime upgrades.
- The report describes the Google Apps Script deployment as a relay to an actor-controlled backend at api.studiotikva[.]com.
- The researchers say CAV3RN’s use of legitimate services to relay C2 traffic can complicate network-based detection.
Article Details
- Attack Vectors
- DNS A-record responses select between direct HTTPS C2 and a Google Apps Script relay for each transaction.
- The framework uses DNS queries under studiotikva.com to validate and recover a Google Apps Script deployment ID.
- GoogleService.dll sends inventory data and receives tasks over the selected C2 channel; responses are Base64-decoded and XORed with 0xAC.
- The local broker scans for DLL components, loads selected modules, routes messages between them, and supports runtime upgrades.
- Defensive Notes
- The report identifies DNS A-record queries using m, q, and p subdomains of studiotikva.com for channel selection and deployment-ID recovery.
- Direct C2 uses api.studiotikva.com and expects an X-Client-Id header; the report describes JSON data encoded with XOR 0xAC and Base64.
- The report identifies GoogleService.dll and rnp.dll as framework components and describes the broker rescanning the host directory for DLLs every second.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]studiotikva[.]com | Actor-controlled backend domain used for direct HTTPS C2 and exposed as the upstream endpoint behind the Apps Script relay. |
| DOMAIN | studiotikva[.]com | Domain used for the framework's DNS control plane; the report says it may have been acquired by the threat actor after expiration, but the ownership-change date is unknown. |
| HOSTNAME | ns1[.]studiotikva[.]com | Nameserver in the reported CAV3RN DNS and C2 infrastructure. |
| HOSTNAME | ns2[.]studiotikva[.]com | Nameserver in the reported CAV3RN DNS and C2 infrastructure. |
| IPV4 | 144[.]172[.]104[.]82 | IP address reported for the CAV3RN nameserver and hosting infrastructure. |
| IPV4 | 144[.]172[.]115[.]17 | IP address reported for the CAV3RN nameserver and hosting infrastructure. |
| MD5 | 2dcd4a8ac166404977cd3c48418a8cd9 | Sample hash listed for the CAV3RN broker component rnp.dll. |
| MD5 | 34d50eec364d920b8b5d885c9bc98607 | Sample hash listed for the CAV3RN component texture.dll. |
| MD5 | 904784c9943d019da332bea2cd03996f | Sample hash listed for the CAV3RN component CommunicationUxTheme.dll. |
| MD5 | 981c7404d31b8ce35ec88a6b290f354d | Sample hash listed for the CAV3RN communication component GoogleService.dll. |
| MD5 | f9156d42410c8a5429dec43329bd72e0 | Sample hash listed for the CAV3RN component net.dll. |
| URL | hxxps[:]//api[.]studiotikva[.]com/ac | Actor-controlled backend endpoint exposed when the Google Apps Script relay timed out. |
| URL | hxxps[:]//api[.]studiotikva[.]com/api/v1/update/check | Configured direct HTTPS C2 endpoint contacted by the communication module. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe module XORs JSON inventory and tasking data with 0xAC and Base64-encodes it for transmission.T1071.001 · Web ProtocolsGoogleService.dll communicates with C2 over HTTPS, including direct requests to api.studiotikva.com and requests relayed through Google Apps Script.T1071.004 · DNSThe framework uses DNS A-record responses to select its C2 channel and to validate or recover the Apps Script deployment ID.T1102 · Web ServiceThe framework uses Google Apps Script as an application-layer relay for C2 requests.T1105 · Ingress Tool TransferThe communication module receives C2 task data and its s_write command decodes and decompresses supplied data before writing it to a file path.T1129 · Shared ModulesThe local broker scans for DLL components, loads selected DLLs, and invokes their exported callbacks.