The stealthy espionage tool that was recently caught hiding its instructions inside Microsoft 365 calendars, in a campaign aimed squarely at organizations in Israel, is the work of OilRig, Iran's long running state hacking group also tracked as APT34, according to new analysis from Kaspersky's GReAT team. The researchers also found something earlier public reporting missed: a fallback channel that lets the malware pull fresh cloud credentials over ordinary DNS lookups when its primary route is cut off.
The finding builds on two stories IntelFusions covered earlier this month. In early July, Check Point Research exposed the wider modular toolkit behind these intrusions, an Iran linked framework it named Cavern Manticore. Days ago, a separate report detailed the specific component that turns a hijacked mailbox calendar into a covert command channel. Kaspersky, which tracks the cluster as Project CAV3RN and has followed it since December 2025, says its independent analysis of that component adds both firmer attribution and previously undocumented tradecraft.
How the calendar channel works
The communication module, a .NET Native AOT library named AzureCommunication[.]dll, ships with a complete configuration baked in: a Microsoft Entra tenant ID, application credentials, the address of a compromised Israeli mailbox, and encryption keys. It signs in to Microsoft Graph as that stolen identity and uses the mailbox's default calendar as a dead drop. Operators plant commands as calendar events, the implant reads and immediately deletes them, and it posts stolen output and heartbeats back as new events. To keep the traffic invisible to anyone glancing at the calendar, every event is scheduled into a single one hour window on May 13, 2050. Commands and results are wrapped in RSA plus AES-256-GCM encryption, so even someone with access to the mailbox cannot read them without the attacker's private key.
The DNS backup channel
The new detail is what happens when that cloud access fails. If the Graph login or tenant check does not go through, the module quietly rebuilds its configuration by asking DNS. It sends a series of AAAA (IPv6) lookups to an attacker run domain, cloudlanecdn[.]com, and treats the returned IPv6 addresses not as network destinations but as containers smuggling out a replacement tenant ID, client ID, client secret and mailbox address, byte by byte across many queries. Because almost every network permits outbound DNS, this hands the operators a resilient way to feed their implant new credentials without touching a suspicious web server. The domain was registered in December 2025 and moved to attacker controlled nameservers in May 2026, timing that Kaspersky assesses lines up with this module's development.
Why Kaspersky points to OilRig
The attribution rests on OilRig's long habit of abusing legitimate Microsoft services for command and control. Past OilRig tools have hidden traffic in Exchange email, Office 365 drafts and OneDrive; CAV3RN simply moves the dead drop into calendar events. Kaspersky had previously tied the cluster to OilRig with low confidence and says the new module strengthens that link. The group has spent years targeting government, energy and telecom organizations across the Middle East, with Israel a recurring focus.
Indicators of compromise
Kaspersky lists the following, defanged here. Configuration recovery domain: cloudlanecdn[.]com. Nameserver hosting IPs (RouterHosting LLC, AS14956): 216[.]126[.]237[.]197 and 144[.]172[.]108[.]205. Module hashes (MD5): caf021dda726b8ba049c2aa395e505a1, c092b02fbc0fdf7ee9608dd016673806 and 29b2b8c5d99f05bfcdd0d8d976eb5678. Defenders should watch for unexpected application sign ins to Microsoft Graph from unfamiliar tenants and for calendar events created far in the future.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.