Project CAV3RN is a modular espionage framework targeting Israel that uses a DNS-based control plane to switch between direct HTTPS and a Google Apps Script relay. The newly documented components include GoogleService.dll and rnp.dll, which support tasking, module discovery, runtime upgrades, and brokered communication. #ProjectCAV3RN #GoogleService.dll #rnp.dll #studiotikva.com
Keypoints
- CAV3RN is a modular espionage framework observed against targets in Israel.
- The framework uses DNS A-record responses to choose per transaction between direct HTTPS C2 and a Google Apps Script relay.
- The communication module is GoogleService.dll, a 64-bit .NET 8 NativeAOT DLL that sends inventory data, receives tasks, and supports internal commands such as s_version, s_config, s_enLog, s_deLog, and s_write.
- The local broker is rnp.dll, which scans for DLLs, loads the highest-version matching components, routes messages, and supports runtime upgrades.
- DNS recovery can validate and replace the Google Apps Script deployment ID, allowing the operator to rotate the relay channel.
- Direct HTTPS traffic goes to api.studiotikva.com and requires the X-Client-Id header; responses are XORed with 0xAC after Base64 decoding.
- Infrastructure includes studiotikva.com, ns1.studiotikva.com, ns2.studiotikva.com, and IPs on RouterHosting LLC / AS 14956.
MITRE Techniques
- [T1071.001] Web Protocols – Uses HTTPS and Google Apps Script web requests for C2 communication (‘contacts the configured ad address, https://api.studiotikva.com/api/v1/update/check’ and ‘inserts the deployment ID into https://script.google.com/macros/s/{deployment-ID}/exec’).
- [T1071.004] DNS – Uses DNS A-record queries to select channels and recover deployment IDs (‘performs a DNS A-record query to select Direct HTTPS or Google Apps Script’ and ‘retrieved through .p queries’).
- [T1105] Ingress Tool Transfer – Receives and writes module data or tasks through the C2 channel, including file writes via s_write (‘Base64-decodes and GZip-decompresses provided data before writing it to the specified file path’).
- [T1027] Obfuscated Files or Information – XORs and Base64-encodes JSON inventory and tasking data to conceal contents (‘serialized as JSON, XORed with 0xAC, Base64-encoded’ and ‘Base64-decoding the response body and XORing it with 0xAC’).
- [T1102] Web Service – Abuses Google Apps Script as a relay and uses legitimate web services for command routing (‘a Google Apps Script relay for each transaction’ and ‘the application-layer relay’).
- [T1569.002] Service Execution – The broker loads DLL components and invokes their callbacks to execute module behavior (‘discovers and loads DLL components, routes messages between them’).
Indicators of Compromise
- [Domains] C2 and relay infrastructure – studiotikva.com, api.studiotikva.com, and other subdomains such as ns1.studiotikva.com and ns2.studiotikva.com
- [IP Addresses] DNS and hosting infrastructure – 144.172.115.17, 144.172.104.82, and other referenced addresses such as 12.121.234.120 and 12.19.29.30
- [URLs] Direct C2 and relay endpoints – https://api.studiotikva.com/api/v1/update/check, https://script.google.com/macros/s/{deployment-ID}/exec, and https://api.studiotikva.com/ac
- [File Names] Identified framework components – GoogleService.dll, rnp.dll, CommunicationUxTheme.dll, net.dll, and texture.dll
- [File Hashes] Sample hashes listed in the report – 904784c9943d019da332bea2cd03996f, f9156d42410c8a5429dec43329bd72e0, and 2dcd4a8ac166404977cd3c48418a8cd9
- [File Paths] Embedded PDB and source paths – C:UsersuserDesktopModulesbroker-caverncommunicationGoogleCommunicationbinReleasenet8.0win-x64nativeGoogleService.pdb and C:UsersuserDesktopModulesbroker-cavern1.outrnp.pdb
- [Registry/Identifiers] Fixed broker and client identifiers – 33A4BA78-E286-4FF2-85EC-7365265F3D93 and generated seven-character client IDs
Read more: https://securelist.com/project-cav3rn-continues/120991/