Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

The Hacker News 17 August 2026, 20:41 EEST Security Domains

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the…

Read the full story on The Hacker News https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html

An expired domain or a forgotten certificate takes a site down just as effectively as an attack. At CrockyHost hosting renewals and SSL are handled for you.

Keep reading

ToxicPanda Android malware uses VPN permissions to block Google Play BleepingComputer
Hackers infect Android car head units with proxy botnet malware BleepingComputer
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 The Hacker News
New SynkLoader malware pushed in Microsoft Teams phishing campaign BleepingComputer