New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

Key Takeaways

• We have been tracking this cluster since December 2025, and in late April 2026, we observed a major architectural shift: the developers moved from a t. Introduction In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophi.
• Subsequently, Check Point Research publicly reported on the same controller-based architecture in July 2026.