[cavern]

August 17, 2026

• Cavern (Cav3rn) C2 evolves with DNS and Google Apps Script. Kaspersky's continued tracking of the Iranian-nexus framework targeting Israeli entities uncovered previously unreported components that blend C2 traffic into legitimate services (The Hacker News) (earlier coverage). · Threat Intelligence

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

July 21, 2026

• HOLLOWGRAPH turns compromised Microsoft 365 mailboxes into a command-and-control channel, using the Microsoft Graph API to pull operator tasks and exfiltrate stolen files as attachments on calendar events dated to the year 2050 — blending malicious traffic into legitimate M365 flows. Group-IB attributes the .NET NativeAOT DLL to the Cavern backdoor framework and a suspected Israel-linked actor; the two-command implant (get/send) exploits no vulnerabilities, relying entirely on trusted cloud infrastructure to evade network detection. Group-IB (via NCSC-FI), The Hacker News. · Threat Activity & Tradecraft

in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live

July 7, 2026

• Cavern (aka Cav3rn / Cavern Manticore), a previously undocumented modular C2 framework tied to Iran's MOIS, is being used against Israeli IT providers and government entities. Check Point documents custom C2 protocols, anti-analysis features, and low detection rates (The Hacker News, Check Point). · Threat Activity

in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary