An espionage framework being used against targets in Israel has added a command channel that is very hard to block: Google's own servers. Kaspersky's Global Research and Analysis Team (GReAT) published new findings on Project CAV3RN showing the toolkit relaying its instructions through Google Apps Script, a legitimate Google scripting service, and using DNS lookups to decide which route to take before every single transaction.
It is the third report on the cluster. Kaspersky first documented it in June 2026 through its private threat intelligence reporting service, then publicly the following month. IntelFusions covered that July write-up, which tied the framework to the Iranian group OilRig; the new report does not restate that attribution and describes the cluster on its own terms. Continued tracking in early August surfaced several components that had not been documented before.
How the traffic hides
The centerpiece is a communication module named GoogleService.dll, a 64-bit library built with Microsoft .NET 8 NativeAOT. Before it polls for a command or sends a result, it makes a DNS lookup against the operators' own domain. The fourth number in the address that comes back tells the implant which path to use for that exchange: a direct HTTPS call to the attackers' server, or a relay hosted on Google Apps Script. One specific answer, 12[.]19[.]29[.]30, is treated as a rejection and the request is dropped.
That design does two things for the operators. It splits their traffic across a channel that resolves to Google infrastructure, which most networks allow by default and few analysts flag, and it gives them a remote control switch. The same DNS infrastructure can hand back a replacement identifier for the Apps Script deployment, so if the relay is taken down the implant can rotate to a new one on its own and write the new value to disk.
GReAT also documented the framework's local broker, the component that finds and loads the other modules, passes messages between them and supports upgrading them while running. The communication module answers five internal commands of its own, including one that inventories every library in its directory with company names and versions, scrambles the list and ships it as the first report home, and one that writes attacker-supplied files to disk.
The cover story
The infrastructure was chosen to look local. The domain studiotikva[.]com fronted a generic "Studio Tikva" website; "tikva" means "hope" in Hebrew, which gave the domain plausible cover in an Israeli network's logs. Kaspersky notes the domain expired in February 2026 and was registered again on May 12, then redelegated a week later to name servers resolving to 144[.]172[.]115[.]17 and 144[.]172[.]104[.]82. The researchers are careful to say the evidence does not show when ownership actually changed, so the domain may originally have belonged to a real Israeli business.
The operators also made a mistake. During an upstream timeout, the Google Apps Script relay leaked the address of the backend it was fronting, hxxps://api[.]studiotikva[.]com/ac, exposing the actor-controlled endpoint behind the Google facade.
What defenders should take from it
Kaspersky's assessment is that CAV3RN will likely keep expanding, based on its development pace, modular design and operational tempo. The pattern to watch is the abuse of trusted services: the framework previously ran its command traffic through Outlook calendar events, and now through Google Apps Script. Blocking the domain of the week does not address that. Detection has to lean on the anomaly rather than the destination, such as an unexpected process making repeated DNS queries with random-looking subdomains, or a desktop application talking to script[.]google[.]com when it has no business doing so.
Reported file hashes include GoogleService.dll (MD5 981c7404d31b8ce35ec88a6b290f354d) and four further modules, with the full indicator set in the GReAT report. Israel remains one of the most heavily targeted countries we track; our Israel profile has the wider context.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.