Actor / Malware Family
CAV3RN
3 queries tagged with this actor.
-
Hunting
Hunt Cav3rn Endpoint Local Log File Artifact
Endpoint-side hunt for Project CAV3RN's local file artifact (`logAzure.txt` and family) — config persistence written by the module.
-
Hunting
Hunt DNS Aaaa Record Covert Recovery Channel
Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.
-
Hunting
Hunt Outlook Calendar C2 Far Future Standing Meeting
Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.