Project CAV3RN Turns Outlook Calendars and DNS Into Covert C2, Bulwark Black

Kaspersky reported a Project CAV3RN module that abuses Microsoft Outlook calendar events and DNS AAAA records for covert command-and-control. Here is what SMBs and government contractors should monitor in Microsoft Graph, Entra ID, endpoint, and DNS logs.

Kaspersky has published new research on a Project CAV3RN communication module that moves command-and-control into places many defenders treat as normal business traffic: Microsoft 365 calendar events and DNS AAAA lookups. That matters because the technique does not depend on an obviously malicious beacon to a strange web server. It hides inside cloud collaboration workflows and routine resolver traffic.

The original research is available from Kaspersky Securelist. Additional public context on the same broader framework and Microsoft Graph abuse has also been published by Group-IB and Check Point Research.

What was reported

The newly described module, identified as AzureCommunication.dll, appears designed to replace an earlier HTTP/WebSocket C2 component in the CAV3RN ecosystem. It is compiled with .NET Native AOT, which strips away much of the metadata analysts normally use to reverse-engineer managed code quickly. The module keeps the same general controller interface, but it shifts transport into Microsoft Graph-backed calendar operations.

Instead of polling a classic C2 endpoint, the malware uses a configured Microsoft 365 mailbox as a dead-drop channel. Operator commands, agent heartbeats, and command output are represented as calendar events in a fixed future time window. Attachments carry encrypted commands and results. The module also includes a fallback path: if Microsoft Graph authentication or tenant validation fails, it attempts to recover replacement Graph configuration values from actor-controlled DNS AAAA responses.

Why this is bigger than one malware family

CAV3RN is interesting because it reflects a broader tradecraft trend: attackers are pushing C2 into trusted SaaS surfaces, identity platforms, and cloud APIs that defenders cannot simply block at the firewall. For government contractors and SMBs using Microsoft 365, this is the same defensive problem that shows up in business email compromise, OAuth abuse, device-code phishing, and malicious enterprise apps: the attacker wants the security team to see “normal Microsoft traffic” instead of an intrusion.

The DNS recovery mechanism adds another layer. The AAAA records are not being used as ordinary IPv6 destinations; they function as small data containers. That lets the malware refresh tenant IDs, client IDs, client secrets, and mailbox values through resolver traffic if the embedded Microsoft Graph configuration stops working.

Defensive takeaways

Watch Microsoft Graph behavior, not just domains. Alert on unusual service-principal or application access to mailboxes, calendar events, and attachments, especially from hosts that should not be automating mailbox workflows.
Baseline calendar API usage. Most endpoints should not create, delete, patch, and attach files to hidden/future calendar events through Graph. Treat unusual calendarView and events activity as security telemetry.
Harden Entra app credentials. Review app registrations, client secrets, consent grants, and mailbox application permissions. Rotate exposed secrets and remove stale high-privilege apps.
Do not ignore DNS AAAA anomalies. Hunt for repeated structured AAAA queries to low-reputation or newly registered domains, especially when query labels encode host-specific identifiers or offsets.
Correlate endpoint and cloud logs. A Windows DLL using Native AOT, a new local config file, Graph API activity, and suspicious DNS together are stronger than any single signal alone.
Control RMM and software deployment paths. Prior reporting on the broader framework describes abuse of legitimate management tooling after initial access. Lock down who can deploy software and require strong audit trails.

Bulwark Black assessment

This is not a mass-ransomware story. It is a reminder that espionage operators are becoming more comfortable living inside the same SaaS and identity workflows defenders rely on every day. If your organization supports federal customers, handles controlled data, or operates as a managed service provider, “Microsoft 365 logs are available somewhere” is not enough. The question is whether your team can explain what normal Graph, calendar, OAuth, and DNS behavior looks like before an incident.

The practical move is to treat collaboration platforms as part of the attack surface. Build detections around abnormal Graph operations, preserve Entra sign-in and audit logs long enough to investigate slow intrusions, and make DNS telemetry searchable by pattern instead of only by domain reputation. CAV3RN’s transport may be specialized, but the defensive lesson is general: trusted cloud services are now intrusion infrastructure.