A sophisticated threat actor has been using a novel technique called Cavern C2 to blend malicious activity with legitimate traffic, evading detection by security systems. This clever tactic leverages Google Apps Script and DNS to create an almost undetectable attack path, putting countless organizations at risk.
Cavern C2 works by utilizing Google’s cloud infrastructure to host malicious scripts within Google Apps Script, a service designed for automating tasks on Google Sheets and Docs. These scripts are then used to establish a command-and-control (C2) channel with compromised systems, all while masquerading as innocuous web traffic. To make matters worse, the attackers use DNS tunneling to conceal their malicious activity within legitimate DNS requests, making it even more challenging for security teams to detect.
The impact of Cavern C2 is far-reaching, affecting any organization that relies on Google services or has employees who use them. This includes businesses with Google Workspace (formerly G Suite) accounts, as well as individuals using Google Drive, Docs, and Sheets. The attackers can potentially gain access to sensitive data, disrupt operations, or even sell this information on the dark web.
So, how does Cavern C2 function? Here’s a simplified explanation: when an attacker wants to establish a connection with a compromised system, they use a Google Apps Script to create a malicious script that communicates with the compromised device. This script is then embedded within a legitimate DNS request, which the attackers use to tunnel their malicious activity through Google’s infrastructure. The result is an almost undetectable communication channel between the attacker and the compromised system.
The key takeaway from this story is that Cavern C2 highlights the importance of monitoring DNS traffic for suspicious activity. This may seem obvious, but many organizations still rely on traditional security measures to detect and prevent attacks. With Cavern C2, attackers have shown that they can evade detection by using cloud services like Google Apps Script in a malicious manner.
To mitigate this risk, it’s essential for organizations to implement robust DNS monitoring and anomaly detection tools. Additionally, they should educate their employees about the risks associated with using Google services and ensure that all scripts and macros are properly vetted before being executed on company systems.
Source: The Hacker News — 2026-08-17