Cavern C2 Abuses DNS and Google Apps Script for Covert Iranian Ops

Tue, 18 Aug 2026 11:37:25 +0000

Engineer — Learn: The technique of tunneling C2 traffic through DNS and Google Apps Script highlights the risk of assuming cloud-provider traffic is benign; worth reviewing egress controls and whether Google Apps Script domains are in a blanket allow-list on your proxy.
SOC/IR — Plan: Build or tune detections for anomalous DNS query volumes and unexpected Google Apps Script callouts from non-developer endpoints; the covert channel technique is novel enough to warrant adding hunt logic this quarter, though no specific IOCs are surfaced in this report.
Leader — Learn: Iranian nation-state actor using legitimate cloud services to mask C2 is relevant threat-landscape context, particularly for organizations with Israeli business ties, but no immediate leadership action is required.

Dns-Tunneling on CuraSec