Project CAV3RN Continues DNS-Controlled Multi-Transport C2 a...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/project-cav3rn-continues/120991
• Blog Title: Project CAV3RN Continues: DNS-Controlled Multi-Transport C2 and a Modular DLL Broker
• Suggested Section: Basic Forensic Methodology > Malware Analysis > DNS-Controlled Multi-Transport C2 and Modular DLL Brokers

🎯 Content Summary

Overview and impact

Project CAV3RN is a modular Windows cyberespionage framework used against targets in Israel. This report extends earlier analysis and documents components discovered in early August 2026. It does not describe a CVE, vulnerable third-party product, initial-access vector, or standalone exploit. Instead, it reverse-engineers two ope...

🔧 Technical Details

DNS as a C2 control plane: An implant can issue an authoritative DNS query before each command poll or result upload and encode a random nonce, transport error state, and hex-encoded client identifier in the query name. The authoritative server's A-record response can act as a compact routing instruction: a specific full address can reject the client, while the final octet can select direct HTTPS, a trusted-service relay, transaction termination, or exception handling. Tracking separate relay-ID, relay-transport, and direct-transport failure states allows server-directed failover without updating the implant.

Rotating cloud relay identifiers over DNS: Malware can hash its currently stored cloud deployment ID and compare a truncated digest against four bytes returned in an A record. On mismatch, it can reconstruct a replacement using sequential DNS answers: the first response contains a total-length byte and three data bytes, and subsequent res...

🤖 Agent Actions

Plan:

1. Map the malware-analysis and C2 documentation structure.
2. Read at least five candidate pages and search for overlapping DNS, cloud-relay, DLL-loading, and file-deployment techniques.
3. Select one existing page (or, only if necessary, create and link one new page).
4. Add concise, abstracted technical content with numbered citations.
5. Verify the diff, references, formatting, and repository status.
   Repository review is complete. The best fit is the existing malware-analysis.md: it already covers NativeAOT modular implants, universal exports, Base64/GZip-delivered DLL updates, and traffic decoding. I’ll extend that single page with the genuinely new techniques—DNS-per-transaction routing, DNS relay-ID rotation, Apps Script relaying, and metadata-driven DLL hot-loading—without duplicating the already documented update pattern.
   Implementation is complete in one existing page. I’m now validating citation numbering, Markdown structure, banned-source absence in the added diff, and repository cleanliness.
   Updated:

src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md

Added technical coverage of:

• DNS-controlled per-transaction transport selection
• DNS-based cloud relay identifier rotation
• Google Apps Script C2 relaying
• Header-gated direct HTTPS fallback
• Nested Base64/XOR task decoding
• Metadata-driven DLL hot-loading and broker discovery
• Correlated DNS, proxy, and endpoint investigation pivots

Appended the Securelist article as numbered reference [24]. Validation passed with git diff --check; only the intended file was modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/project-cav3rn-continues/120991

Content Categories: Based on the analysis, this content was categorized under "Basic Forensic Methodology > Malware Analysis > DNS-Controlled Multi-Transport C2 and Modular DLL Brokers".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0