CAV3RN adopts Google Apps Script relay and DNS‑based channel switching
The article reveals that the espionage framework CAV3RN now uses a .NET NativeAOT DLL that can pick between direct HTTPS and a Google Apps Script relay based on DNS A‑record responses, allowing operators to rotate channels and hide traffic in legitimate Google services. This modular C2 design complicates detection and shows the group’s focus on Israeli targets.