Project CAV3RN hides C2 in Outlook calendar events with DNS fallback
Project CAV3RN introduced a .NET Native AOT module that hides its command‑and‑control traffic inside Outlook calendar events via Microsoft Graph, and falls back to DNS AAAA replies when Graph auth fails. This dual‑use of everyday cloud services lets the malware blend in with legitimate traffic, complicating network detection and remediation.