Cavern picks its C2 channel via a DNS query and hides inside Google Apps Script and Microsoft 365 calendars

The Iranian Cavern C2 framework has added a module that queries DNS to choose between a direct HTTPS channel and a Google Apps Script relay, plus another that turns Microsoft 365 calendars into a dead-drop. For network detection, indicator blocklists are no longer enough: you have to watch for anomalous DNS queries and abuse of legitimate services.