New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
2026-07-21T08:51:48Z•19eeb113f3ba8233fc85f6c90be6855bce272748878df4d80bce051b42d1e4a4
AI-generated loadersArmored LikhoAsyncRATBusySnake StealerC2 fallbackDNS AAAADevice Authorization GrantGoSerpentHelloNetMicrosoft GraphOAuth Device Code phishingOkoBotOpenClaw vulnerabilities','compromise-assessmentOutlook calendar C2Project CAV3RNRilide stealerScreenConnectStowaway RATTookPSViPNetbrowser monitoringdata exfiltrationindustrial-threats-Q1-2026seed phrase theftsupply-chain compromise
What happened
Kaspersky Securelist highlights multiple active, high-impact threats and trends observed in mid-2026: Project CAV3RN — a new cyber-espionage C2 module that abuses Outlook calendar events via Microsoft Graph with a DNS AAAA-based backup channel for configuration recovery; supply-chain/targeted infection attempts using the ViPNet update system (HelloNet); GoSerpent campaigns using multi-stage backdoors (including Stowaway RAT) and sophisticated data collection/exfiltration; OkoBot — a modular framework targeting cryptocurrency users that exfiltrates seed phrases, monitors Chromium-based browsers
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 19eeb113f3ba8233fc85f6c90be6855bce272748878df4d80bce051b42d1e4a4
- Enrichment time
- 2026-07-21T08:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.