Most malware gets caught because it talks funny. Unusual outbound connections, strange ports, suspicious domains — network defenders have spent years training detection tools to spot the tell. A newly documented command-and-control framework called Cavern C2 is designed to eliminate every one of those red flags by routing attacker communications through infrastructure that security teams are actively trained to trust: DNS and Google Apps Script. According to The Hacker News, Cavern C2 encodes operator commands inside DNS TXT records and uses Google’s own script execution platform as a relay — making malicious traffic blend seamlessly into the kind of legitimate, high-volume requests that most enterprise firewalls wave through without a second look. For security teams already stretched thin by an exploding vulnerability landscape, this is a significant escalation in the evasion arms race. Our earlier coverage of cybersecurity strategy shifts makes clear just how much pressure defenders are already under before frameworks like this enter the picture.
The core technique is elegant in a deeply uncomfortable way. DNS TXT records were designed to carry human-readable text annotations — SPF records, domain verification strings, that kind of thing. They generate enormous volumes of routine traffic on any corporate network, and blocking them outright would break legitimate operations. Cavern C2 exploits that reality by stuffing encoded command data directly into TXT record responses, meaning an infected host can receive new instructions from an operator simply by making what looks like a routine DNS lookup. No suspicious HTTP POST to an unknown IP. No obvious callback domain. Just DNS traffic, indistinguishable from thousands of other queries hitting the same resolver every minute.
Google Apps Script as an Unwitting Relay
The second channel Cavern C2 uses is arguably more audacious. Google Apps Script is a legitimate cloud-based automation platform tied to Google Workspace — used by millions of businesses to build internal tools, run scheduled tasks, and connect productivity apps. Cavern C2 abuses it as a data exfiltration and command relay channel, leveraging the fact that outbound HTTPS traffic to script.google.com is explicitly whitelisted in most enterprise security policies. Blocking it would cripple Google Workspace functionality, so most organizations simply can’t. Traffic flowing to and from Apps Script looks, to every conventional inspection tool, like a developer running a spreadsheet macro or a scheduled workflow.
This dual-channel architecture — DNS for inbound commands, Google’s platform for outbound data — gives Cavern C2 a redundancy and legitimacy profile that most C2 frameworks cannot match. Traditional indicators of compromise, like hardcoded IPs or registered attacker domains, are largely absent. That makes signature-based detection almost useless and puts enormous pressure on behavioral analysis tools to catch the anomaly in how a host is using those channels rather than simply where it’s connecting.
What Defenders Are Up Against
Cavern C2’s design reflects a broader and accelerating trend: attackers are systematically moving their infrastructure onto platforms that defenders have contractual, operational, or technical reasons to trust. Living-off-the-land techniques that abuse native OS tools have been mainstream for years, but the expansion into legitimate SaaS platforms and core internet protocols represents a harder problem. You cannot simply block DNS. You cannot firewall Google. The attack surface is, by design, load-bearing infrastructure.
For enterprise security teams, the practical response has to shift toward anomaly detection at the behavioral layer — monitoring for unusual TXT record query volumes, unexpected patterns in Apps Script execution frequency, or hosts that are querying DNS at intervals suspiciously consistent with a polling loop. None of those signals are easy to tune without generating a flood of false positives. The coverage from Microsoft’s patch record earlier this year underscored just how many attack surfaces defenders are already managing. Cavern C2 adds a new dimension to that burden by weaponizing the infrastructure defenders rely on to keep everything else running.
