Kaspersky researchers have identified a significant architectural shift in Project CAV3RN, a modular cyberespionage framework attributed with low confidence to the OilRig (APT34) group. The latest module, AzureCommunication.dll, represents a move from traditional HTTP/WebSocket communications to a sophisticated dead-drop mechanism leveraging Microsoft Graph and Outlook calendar events. By scheduling events for the year 2050 and using encrypted attachments for command exchange, the actors effectively hide their activities within legitimate enterprise cloud traffic.
A standout feature of this update is its resilient fallback mechanism that utilizes DNS AAAA records to recover configuration details. If primary authentication fails, the module queries actor-controlled authoritative nameservers and reconstructs Microsoft Entra credentials from the returned IPv6 addresses. This innovative use of DNS as a data retrieval protocol, combined with .NET Native AOT compilation to hinder analysis, underscores the continuous evolution of the framework's operational security and persistence capabilities.
Top comments (0)