SocGholish Dropcatch Scavengers + Project CAV3RN Google Apps Script C2: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Threat Summary

Two fresh OTX pulses published 2026-08-13/14 expose parallel but complementary criminal and espionage tradecraft that enterprise defenders must treat as a single detection problem: abuse of trusted web infrastructure to mask malicious traffic.

The first pulse, sourced from Infoblox research, documents three financially motivated actors — Stuffy Squirrel, Shady Squirrel, and a third unnamed cluster — that acquire expired domains with malicious history via dropcatch services. Because these domains were previously used in compromised-site campaigns, they inherit residual traffic from stale injected scripts still present on victim websites. The actors monetize this inherited traffic by reselling it to affiliate advertising networks, tech-support scam operators, and SocGholish fake-browser-update distribution chains. Shady Squirrel additionally deploys custom JavaScript with Keitaro TDS (Traffic Distribution System) injections and multi-step cloaking to separate scanners from monetizable victims. Targeting is concentrated in the United States and Japan.

The second pulse, from Securelist, tracks Project CAV3RN, a modular espionage framework targeting entities in Israel. CAV3RN has evolved a resilient C2 architecture: DNS A-record responses are used as a decision channel that instructs implants whether to communicate via direct HTTPS or relay through Google Apps Script — effectively laundering C2 traffic through Google's own cloud infrastructure. Its modules (GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, texture.dll) masquerade as legitimate system and Google-branded libraries, and the framework supports DNS tunneling as a fallback channel.

Collectively these pulses show both crimeware and espionage operators converging on the same doctrine: inherit or borrow the reputation of legitimate infrastructure (expired domains, Google cloud) to defeat reputation-based filtering.

Threat Actor / Malware Profile

Dropcatch Scavengers (Stuffy Squirrel / Shady Squirrel) — SocGholish Ecosystem

Distribution method: Acquisition of expired, previously malicious domains via dropcatch auctions; inherited injected JavaScript on long-compromised legitimate sites silently redirects residual visitors.
Payload behavior: Traffic is cloaked and fingerprinted (multi-step cloaking via Keitaro), then routed to affiliate fraud schemes, tech-support scams, or SocGholish fake browser-update lures that deliver a NetSupport RAT / follow-on loader chain.
C2 communication: Keitaro TDS endpoints and push-monetization domains (e.g., propush.me, imhd.io) broker and redirect sessions over HTTPS.
Persistence mechanism: Server-side only — persistence lives in the stale injected scripts on compromised third-party sites and in the dropcatched domain registrations, not on the endpoint.
Anti-analysis techniques: Stuffy Squirrel hides logic inside legitimate-looking scripts; Shady Squirrel uses multi-step cloaking that serves benign content to sandboxes, security crawlers, and non-target geographies.

Project CAV3RN — Modular Espionage Framework (Israel Targeting)

Distribution method: Unknown initial vector (consistent with targeted espionage delivery); modular staged deployment.
Payload behavior: Plugin-style modules with deceptive names (GoogleService.dll, CommunicationUxTheme.dll, texture.dll, net.dll, rnp.dll) loaded on demand per operator tasking.
C2 communication: Hybrid channel selection — the implant queries DNS and uses A-record responses to choose per-transaction between direct HTTPS to attacker infrastructure (api.studiotikva.com) and a Google Apps Script relay (script.google.com / script.googleusercontent.com). DNS tunneling provides a low-and-slow fallback. C2 URLs observed include https://api.studiotikva.com/api/v1/update/check — deliberately styled as a benign software-update endpoint.
Persistence mechanism: DLL sideloading / module staging consistent with the framework's masquerading theme (themed DLL names designed to survive casual triage).
Anti-analysis techniques: Dynamic channel rotation, deployment-identifier rotation, trusted-cloud relaying that defeats domain-reputation controls, and DNS-based signaling that blends with normal resolver traffic.

IOC Analysis

The pulse indicator sets split into two operational classes:

Dropcatch / SocGholish cluster (21 indicators, sample shown): Predominantly domains — magesource.su, hpmdnetwork.ru, sport2news.com, propush.me, imhd.io, weatherplllatform.com (note the triple-l typosquat), bluegaslamp.org, draggedline.org. These are redirect, TDS, and monetization nodes. Because the actors churn through dropcatched domains, the pattern (expired-domain re-registration, Keitaro behavior, injected third-party scripts) is more durable than any single domain.

CAV3RN cluster (28 indicators, sample shown): IPv4 (12.19.29.30, 12.121.234.120), domains/hostnames (studiotikva.com, api.studiotikva.com, ns1/ns2.studiotikva.com — actor-controlled authoritative DNS enabling the A-record decision channel), and URLs (/api/v1/update/check, /ac). The dedicated nameservers are the highest-value indicator: any DNS resolution chain involving studiotikva.com nameservers is inherently suspicious.

Operationalization guidance for SOC teams:

Push domains/hostnames to DNS sinkhole and proxy block lists; alert — don't just block — on Google Apps Script destinations (script.google.com, script.googleusercontent.com) from endpoints.
Detonate suspicious URLs in a sandbox (ANY.RUN, Joe Sandbox) to observe Keitaro cloaking behavior and SocGholish update-lure chains.
Enrich dropcatched domains against passive DNS (Infoblox, SecurityTrails, VirusTotal) to identify registration-date anomalies: a domain with 10-year history but a 30-day-old registration is a dropcatch red flag.
Feed the full OTX indicator sets into your TIP/SIEM via the OTX DirectConnect API or STIX/TAXII; set 90-day expiry on domain indicators but retain the CAV3RN IPs and nameserver hostnames indefinitely.

Detection Engineering

YAML

---
title: Project CAV3RN Google Apps Script C2 Relay Activity
id: 7f2a1c4e-9b3d-4e5a-a1c2-cav3rn000001
status: experimental
description: Detects outbound connections to Google Apps Script endpoints from non-browser processes, consistent with CAV3RN framework relaying C2 through Google cloud infrastructure
references:
    - https://securelist.com/project-cav3rn-continues/120991/
author: Security Arsenal Threat Intel
date: 2026/08/14
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'script.google.com'
            - 'script.googleusercontent.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    condition: selection_domain and not filter_browsers
fields:
    - Image
    - DestinationHostname
    - DestinationIp
    - User
falsepositives:
    - Legitimate enterprise Google Workspace automation running from dedicated service hosts
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
---
title: CAV3RN Espionage Framework Infrastructure Resolution
id: 7f2a1c4e-9b3d-4e5a-a1c2-cav3rn000002
status: experimental
description: Detects DNS resolution of known Project CAV3RN C2 infrastructure including actor-controlled nameservers used for the A-record channel-selection mechanism
references:
    - https://securelist.com/project-cav3rn-continues/120991/
author: Security Arsenal Threat Intel
date: 2026/08/14
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'studiotikva.com'
    condition: selection
fields:
    - QueryName
    - Image
    - Computer
falsepositives:
    - Threat hunting and security research activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.004
    - attack.t1568
---
title: SocGholish Fake Browser Update Dropcatch Redirect Domains
id: 7f2a1c4e-9b3d-4e5a-a1c2-dropct000003
status: experimental
description: Detects network connections to dropcatched domains and Keitaro TDS infrastructure associated with Stuffy Squirrel / Shady Squirrel traffic monetization and SocGholish distribution
references:
    - https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/
author: Security Arsenal Threat Intel
date: 2026/08/14
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'magesource.su'
            - 'hpmdnetwork.ru'
            - 'sport2news.com'
            - 'propush.me'
            - 'imhd.io'
            - 'weatherplllatform.com'
            - 'bluegaslamp.org'
            - 'draggedline.org'
    condition: selection
fields:
    - Image
    - DestinationHostname
    - DestinationIp
    - Initiated
falsepositives:
    - None expected; these are confirmed malicious monetization and redirect nodes
level: high
tags:
    - attack.command_and_control
    - attack.initial_access
    - attack.t1189

KQL — Microsoft Sentinel / Defender

// CAV3RN + Dropcatch/SocGholish unified network hunt — Microsoft Sentinel
let cav3rnDomains = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com"]);
let dropcatchDomains = dynamic(["magesource.su", "hpmdnetwork.ru", "sport2news.com", "propush.me", "imhd.io", "weatherplllatform.com", "bluegaslamp.org", "draggedline.org"]);
let gasRelay = dynamic(["script.google.com", "script.googleusercontent.com"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | extend Host = tostring(parse_url(RemoteUrl).Host)
    | where RemoteUrl has_any (cav3rnDomains, dropcatchDomains)
       or Host has_any (cav3rnDomains, dropcatchDomains)
       or (Host has_any (gasRelay) and InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
),
(
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "DnsQueryResponse" or AdditionalFields has "studiotikva"
    | where AdditionalFields has_any (cav3rnDomains)
    | project TimeGenerated, DeviceName, ActionType, AdditionalFields
)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), count() by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by LastSeen desc

PowerShell

# CAV3RN + SocGholish/Dropcatch endpoint hunt — run elevated on suspected hosts
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Suspicious CAV3RN-themed DLLs in user-writable or non-standard paths
$suspectDlls = @('GoogleService.dll','CommunicationUxTheme.dll','net.dll','rnp.dll','texture.dll')
$searchPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP", "$env:ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -Include $suspectDlls -File | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $report += [PSCustomObject]@{Check='CAV3RN DLL'; Path=$_.FullName; Signed=$sig.Status; Modified=$_.LastWriteTime}
    }
}

# 2. DNS cache evidence of C2 / dropcatch resolution
$badDomains = @('studiotikva.com','magesource.su','hpmdnetwork.ru','sport2news.com','propush.me','imhd.io','weatherplllatform.com','bluegaslamp.org','draggedline.org')
$dns = Get-DnsClientCache | Where-Object { $e=$_.Entry; $badDomains | Where-Object { $e -like "*$_*" } }
$dns | ForEach-Object { $report += [PSCustomObject]@{Check='DNS Cache Hit'; Path=$_.Entry; Signed=$_.Data; Modified='N/A'} }

# 3. Established connections to CAV3RN IPs and Google Apps Script relays
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemoteAddress -in @('12.19.29.30','12.121.234.120')
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [PSCustomObject]@{Check='C2 Connection'; Path=$proc.Path; Signed=$_.RemoteAddress; Modified='LIVE'}
}

# 4. Persistence sweep: Run keys + scheduled tasks referencing themed DLLs or scripts
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
                  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match 'GoogleService|CommunicationUxTheme|texture\.dll|\.js |wscript|cscript' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='Run Key Persistence'; Path=$_.Name; Signed=$_.Value; Modified='N/A'} }

Get-ScheduledTask | ForEach-Object {
    $t = $_
    $t.Actions | Where-Object { $_.Execute -match 'wscript|cscript|powershell' -and $_.Arguments -match '\.js|http' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='Suspicious Scheduled Task'; Path=$t.TaskName; Signed="$($_.Execute) $($_.Arguments)"; Modified='N/A'} }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\cav3rn_socgholish_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. Findings: $($report.Count)"

Response Priorities

Immediate (0–4h):

Block the dropcatch/SocGholish domains and CAV3RN IPs/hostnames at DNS resolver, proxy, and EDR network layers; sinkhole studiotikva.com and its nameservers.
Alert on (do not silently block) endpoint connections to script.google.com / script.googleusercontent.com from non-browser processes — legitimate Workspace automation exists, but this is CAV3RN's primary relay channel.
Deploy the Sigma and KQL detections above; run the PowerShell hunt on any host that resolved the listed domains in the last 30 days of DNS logs.

24 hours:

For hosts with confirmed SocGholish fake-update execution: assume credential and session-token theft (SocGholish chains routinely lead to NetSupport RAT and data staging). Force password resets and revoke active sessions/tokens for affected users; verify MFA re-enrollment events.
For CAV3RN exposure (especially Israel-based entities): treat as espionage — preserve memory images and forensic artifacts before remediation; check for staged module DLLs and lateral movement from the initial host.
Audit web properties you operate for stale injected third-party scripts that may still be beaconing to now-dropcatched attacker domains.

1 week:

Implement egress policy restricting Google Apps Script endpoints to an allowlist of sanctioned Workspace automation hosts.
Add passive-DNS monitoring for domain re-registration anomalies (dropcatch pattern: old history, new registration date) for domains present in your historic proxy logs.
Restrict script interpreters (wscript/cscript) via WDAC/AppLocker for standard users, and enable DNS query logging at the resolver to catch A-record-driven channel selection and DNS tunneling fallback.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

SocGholish Dropcatch Scavengers + Project CAV3RN Google Apps Script C2: OTX Pulse Analysis — Enterprise Detection Pack