Project CAV3RN Framework & AiTM Phishing Campaign: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Current OTX pulse data reveals two distinct but sophisticated threat campaigns requiring immediate enterprise attention:

AiTM Phishing Campaign: An active adversary-in-the-middle (AiTM) operation using procurement-themed lures to target education, government, and finance sectors globally. Since May 2026, this campaign has leveraged compromised organizational email accounts to distribute sophisticated phishing templates mimicking requests for information, bid invitations, and project documentation. The operation utilizes EvilProxy infrastructure to bypass MFA controls and hijack sessions, with ties to the FlowerStorm and Kali365 threat clusters.
Project CAV3RN Framework: The CHRYSENE threat actor has introduced a new .NET Native AOT communication module for their cyberespionage framework specifically targeting Israeli entities. This module represents an evolution in C2 communication, moving from traditional HTTP/WebSocket channels to Microsoft Graph API, where commands and results are concealed within Outlook calendar events. The framework includes multiple components including RDAT (S0495), SC5k, OilCheck, OilBooster, Solar, WhisperGate (S0689), and Veaty.

Both campaigns demonstrate advanced techniques designed to evade traditional security controls—AiTM phishing bypassing MFA, and CAV3RN using legitimate APIs for covert command and control.

Threat Actor / Malware Profile

CHRYSENE - Project CAV3RN

Classification: Nation-state affiliated cyberespionage actor
Primary Target: Israeli entities and infrastructure
Framework Components: CAV3RN (core framework), RDAT (S0495), SC5k, OilCheck, OilBooster, Solar, WhisperGate (S0689), Veaty

Distribution Method:

Initial infection vector not specified in current pulse data
Previous campaigns have utilized spear-phishing with weaponized documents

Payload Behavior:

.NET Native AOT communication module provides cross-platform compatibility
New module exclusively uses Microsoft Graph API for C2 communications
Commands stored in Outlook calendar events with timestamps between 2050-05-13 22:00-23:00 UTC
Future-dated events used to avoid immediate detection

C2 Communication:

Previous: HTTP/WebSocket channels
Current: Microsoft Graph API via Outlook calendar events
Exfiltrates data through calendar event descriptions
Uses specific subject patterns to identify command instructions

Persistence Mechanism:

Likely uses scheduled tasks or registry run keys (based on similar frameworks)
May leverage Outlook startup hooks

Anti-Analysis Techniques:

Native AOT compilation prevents traditional .NET decompilation
Future-dated calendar events delay detection
Legitimate API usage evades network traffic analysis

AiTM Phishing Campaign

Attribution: Unknown (associations with FlowerStorm and Kali365)
Tools: EvilProxy, commercial phishing service

Distribution Method:

Compromised organizational email accounts
Procurement-themed lures (RFIs, bid invitations, project documentation)
Tailored for targeted industries (education, government, finance)

Payload Behavior:

AiTM proxy intercepts authentication credentials
Captures session tokens for MFA bypass
EvilProxy service provides reverse proxy capabilities

C2 Communication:

Uses EvilProxy infrastructure
Domain-based command and control
Likely integrates with legitimate-looking domains from the IOC list

IOC Analysis

Indicator Types Present:

Domains: 9 domains from AiTM campaign and 3 from CAV3RN framework
FileHash-SHA256: 3 hashes for CAV3RN components
FileHash-MD5: 2 hashes for CAV3RN components

SOC Operationalization:

Domain Blocking: Implement immediate DNS sinkholing for all listed domains
Endpoint Detection: Deploy YARA rules targeting the file hashes
Network Monitoring: Configure firewalls/proxies to alert on connections to identified domains
Authentication Analysis: Review Azure AD logs for anomalous sign-in patterns associated with AiTM indicators

Tooling Recommendations:

VirusTotal/JoeSandbox for hash analysis
AlienVault OTX API for continuous IOC updates
Microsoft Defender for Endpoint for hash-based detections
Azure Sentinel for identity and authentication telemetry

Detection Engineering

Sigma Rules

YAML

---
title: CAV3RN - Outlook Calendar C2 via Microsoft Graph API
description: Detects suspicious Microsoft Graph API calls to Outlook calendar with future dates, potentially related to CAV3RN malware
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/07/22
references:
  - https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/
tags:
  - attack.command_and_control
  - attack.t1071.003
logsource:
  product: azure
  service: signin
detection:
  selection:
    AppDisplayName|startswith: 'Microsoft Graph'
    ResourceDisplayName: 'Office 365 Exchange Online'
  timeframe: 1h
  condition: selection | count() > 5
falsepositives:
  - Legitimate calendar management applications
level: high

---
title: EvilProxy - AiTM Phishing Domain Access
description: Detects connections to known EvilProxy infrastructure and AiTM phishing domains
date: 2026/07/22
author: Security Arsenal Threat Intelligence
references:
  - https://www.infoblox.com/blog/threat-intelligence/the-procurement-trap-inside-an-aitm-campaign-targeting-global-institutions/
tags:
  - attack.credential_access
  - attack.t1059.006
  - attack.t1557.002
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'sohantraders.com'
      - 'satoriestate.com'
      - 'duemineral.uk'
      - 'assessmentevaluationreport.com'
      - 'barifurniture.net'
      - 'consistenthostinghub.de'
      - 'corporatetermscompliance.com'
      - 'cloudlanecdn.com'
      - 'clipeditskill.com'
      - 'accesslinkssl.com'
  condition: selection
falsepositives:
  - Unknown - these domains are part of active phishing campaigns
level: critical

---
title: CAV3RN - Suspicious .NET Native AOT Process Execution
description: Detects execution of .NET Native AOT compiled binaries which are uncommon in enterprise environments
date: 2026/07/22
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '.exe'
    Company:
      - ''
    OriginalFileName|contains:
      - '.dll'
      - '.ni.dll'
  filter:
    Signed|startswith: 'Microsoft'
  condition: selection and not filter
falsepositives:
  - Legitimate .NET Native AOT applications (rare in enterprise)
level: high

KQL Hunt Query (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for CAV3RN-related Microsoft Graph API activity
let future_threshold = datetime(2026-07-22);
let suspicious_apps = dynamic(["Microsoft Graph", "Outlook"]);
let known_hash = dynamic(["75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509", "b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff", "f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3"]);
let known_domains = dynamic(["sohantraders.com", "satoriestate.com", "duemineral.uk", "assessmentevaluationreport.com", "barifurniture.net", "consistenthostinghub.de", "corporatetermscompliance.com", "cloudlanecdn.com", "clipeditskill.com", "accesslinkssl.com"]);

// Microsoft Graph API suspicious activity
let GraphActivity =
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where AppDisplayName in (suspicious_apps)
    | where ResourceDisplayName == "Office 365 Exchange Online"
    | extend UserPrincipalName = tostring(Properties.userPrincipalName)
    | where ResultType != 0
    | summarize count() by AppDisplayName, UserPrincipalName, bin(TimeGenerated, 1h)
    | where count_ > 5;

// File hash detections
let FileHashActivity =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in (known_hash) or MD5 in (dynamic(["29b2b8c5d99f05bfcdd0d8d976eb5678", "c092b02fbc0fdf7ee9608dd016673806"]))
    | project DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, MD5;

// Network connections to known malicious domains
let NetworkActivity =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (known_domains)
    | summarize count() by DeviceName, RemoteUrl, InitiatingProcessAccountName, bin(TimeGenerated, 1h);

union GraphActivity, FileHashActivity, NetworkActivity

PowerShell IOC Hunt Script

PowerShell

# CAV3RN and AiTM Phishing IOC Hunt Script
# Security Arsenal Threat Intelligence - 2026-07-22

# Configuration
$CAV3RN_Hashes = @(
    "75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509",
    "b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff",
    "f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3"
)

$MD5_Hashes = @(
    "29b2b8c5d99f05bfcdd0d8d976eb5678",
    "c092b02fbc0fdf7ee9608dd016673806"
)

$MaliciousDomains = @(
    "sohantraders.com",
    "satoriestate.com",
    "duemineral.uk",
    "assessmentevaluationreport.com",
    "barifurniture.net",
    "consistenthostinghub.de",
    "corporatetermscompliance.com",
    "cloudlanecdn.com",
    "clipeditskill.com",
    "accesslinkssl.com"
)

# Function to scan for malicious file hashes
function Test-FileHashes {
    Write-Host "[*] Scanning for known CAV3RN file hashes..." -ForegroundColor Yellow
    
    $potentiallyMalicious = @()
    $commonPaths = @(
        "$env:USERPROFILE\Downloads",
        "$env:TEMP",
        "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
        "$env:PUBLIC\Downloads"
    )
    
    foreach ($path in $commonPaths) {
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue -File |
            ForEach-Object {
                try {
                    $sha256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                    $md5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
                    
                    if ($sha256 -in $CAV3RN_Hashes -or $md5 -in $MD5_Hashes) {
                        $potentiallyMalicious += $_.FullName
                    }
                } catch {
                    # Skip files that can't be read
                }
            }
        }
    }
    
    if ($potentiallyMalicious.Count -gt 0) {
        Write-Host "[!] Found potentially malicious files:" -ForegroundColor Red
        $potentiallyMalicious | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }
    } else {
        Write-Host "[+] No known malicious files found." -ForegroundColor Green
    }
    
    return $potentiallyMalicious
}

# Function to check DNS cache for malicious domains
function Test-DNSCache {
    Write-Host "[*] Checking DNS cache for malicious domains..." -ForegroundColor Yellow
    
    $dnsHits = @()
    try {
        $dnsCache = Get-DnsClientCache -ErrorAction Stop
        foreach ($domain in $MaliciousDomains) {
            $matches = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
            if ($matches) {
                $dnsHits += $domain
            }
        }
    } catch {
        Write-Host "[!] Could not access DNS cache. Run as Administrator." -ForegroundColor Yellow
        return @()
    }
    
    if ($dnsHits.Count -gt 0) {
        Write-Host "[!] Found DNS cache entries for malicious domains:" -ForegroundColor Red
        $dnsHits | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }
    } else {
        Write-Host "[+] No DNS cache entries for malicious domains." -ForegroundColor Green
    }
    
    return $dnsHits
}

# Function to check for suspicious .NET Native AOT processes
function Test-SuspiciousProcesses {
    Write-Host "[*] Checking for suspicious processes..." -ForegroundColor Yellow
    
    $suspiciousProcesses = @()
    $processes = Get-Process -ErrorAction SilentlyContinue
    
    foreach ($process in $processes) {
        if ($process.Path) {
            try {
                $fileInfo = Get-Item $process.Path -ErrorAction Stop
                $fileHash = (Get-FileHash -Path $process.Path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                
                # Check for unsigned executables in common locations
                if ($fileInfo.Extension -eq '.exe' -and -not (Get-AuthenticodeSignature $process.Path -ErrorAction SilentlyContinue).SignerCertificate) {
                    # Check if it's a .NET Native AOT binary (has unusual PE characteristics)
                    $peBytes = [System.IO.File]::ReadAllBytes($process.Path)
                    if ($peBytes.Length -gt 64) {
                        $peOffset = [BitConverter]::ToInt32($peBytes[60..63], 0)
                        $peSignature = [System.Text.Encoding]::ASCII.GetString($peBytes[$peOffset..($peOffset+3)])
                        if ($peSignature -eq "PE\0\0") {
                            # Check for .NET directory header (if .NET Native AOT, this may be missing or modified)
                            $dotNetOffset = [BitConverter]::ToInt32($peBytes[$peOffset+232..$peOffset+235], 0)
                            if ($dotNetOffset -eq 0) {
                                # Possible Native AOT binary
                                $suspiciousProcesses += [PSCustomObject]@{
                                    ProcessName = $process.ProcessName
                                    PID = $process.Id
                                    Path = $process.Path
                                    Hash = $fileHash
                                }
                            }
                        }
                    }
                }
            } catch {
                # Skip inaccessible processes
            }
        }
    }
    
    if ($suspiciousProcesses.Count -gt 0) {
        Write-Host "[!] Found potentially suspicious processes:" -ForegroundColor Red
        $suspiciousProcesses | Format-Table -AutoSize
    } else {
        Write-Host "[+] No suspicious processes detected." -ForegroundColor Green
    }
    
    return $suspiciousProcesses
}

# Main execution
Write-Host "=================================================" -ForegroundColor Cyan
Write-Host "CAV3RN and AiTM Phishing IOC Hunt Script" -ForegroundColor Cyan
Write-Host "Security Arsenal Threat Intelligence" -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan
Write-Host ""

$maliciousFiles = Test-FileHashes
$maliciousDNS = Test-DNSCache
$suspiciousProcesses = Test-SuspiciousProcesses

# Summary
Write-Host ""
Write-Host "=================================================" -ForegroundColor Cyan
Write-Host "Hunt Summary:" -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan
Write-Host "Malicious Files Found: $($maliciousFiles.Count)" -ForegroundColor Cyan
Write-Host "Malicious DNS Entries Found: $($maliciousDNS.Count)" -ForegroundColor Cyan
Write-Host "Suspicious Processes Found: $($suspiciousProcesses.Count)" -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan

if ($maliciousFiles.Count -gt 0 -or $maliciousDNS.Count -gt 0 -or $suspiciousProcesses.Count -gt 0) {
    Write-Host "[!] DETECTIONS FOUND. Recommend immediate investigation." -ForegroundColor Red
    exit 1
} else {
    Write-Host "[+] No detections found." -ForegroundColor Green
    exit 0
}

Response Priorities

Immediate Actions (Within 1 hour)

Block all identified domains at DNS, firewall, and proxy levels
Deploy file hash detections across endpoint protection platforms
Initiate hunt for CAV3RN malware using provided PowerShell script
Review recent Microsoft Graph API logs for suspicious calendar activity
Enable enhanced logging for Outlook calendar events in M365 environment

24-Hour Actions

Conduct identity verification for users who may have accessed procurement-themed emails
Review Azure AD sign-in logs for unusual authentication patterns
Analyze any security alerts related to the identified file hashes
Perform forensic collection on potentially compromised endpoints
Brief incident response team on both threat campaigns

1-Week Actions

Implement application-specific conditional access policies for Microsoft Graph API
Review and harden email security controls against AiTM phishing techniques
Deploy enhanced monitoring for procurement-related email communications
Conduct security awareness training focusing on AiTM and MFA bypass techniques
Review Microsoft 365 auditing and ensure comprehensive logging is enabled
Implement behavioral analytics for Outlook calendar activity

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Project CAV3RN Framework & AiTM Phishing Campaign: OTX Pulse Analysis — Enterprise Detection Pack