Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
More on Legitimate
Other advisories
- Not ratedosv:CLEANSTART-2024-ZR04755When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator
- Not ratedosv:CLEANSTART-2025-WO88765By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolutio...
- Not ratedosv:CLEANSTART-2024-SC60568When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator
- HighCVE-2026-95184Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
- HighCVE-2026-95209An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).
- MediumCVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.
- LowCVE-2026-44687Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
- Not ratedosv:CVE-2026-47133ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots
Other news entries
- PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South AsiaNewsDark Reading
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH BackdoorNewsThe Hacker News
- 3 Ways AI Agents Already Operate in Your BrowserNewsBleepingComputer
- Fake ChatGPT, Claude apps spread malware via signed AI binariesNewsCSO Online
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign ExposedNewsThe Hacker News
- zkLink Nova's Ethereum bridge drained of about $786K through a forged batch rootBreachpwn.watch
- The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses HardestNewsBleepingComputer
- You gave your AI agent access, but who is giving it orders?NewsBleepingComputer
Source: https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html
ID