OilRig hides C2 commands inside Outlook calendar events

THE article discusses Project CAV3RN, a cyberespionage framework linked to the OilRig group, now incorporating Microsoft Graph to communicate through Outlook calendar events. The previously used HTTP/WebSocket components were replaced by this new architecture, allowing commands and results to be exchanged securely. Key features include a new C2 module (`AzureCommunication.dll`) for command management, and a DNS AAAA-based mechanism for configuration recovery. The framework's adaptability and ongoing development highlight persistent threats in the cybersecurity landscape.