Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Threat Actors
Excerpt
Introduction In June 2026, as part of our Kaspersky Threat Intelligence Reporting service , we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and in late April 2026 we observed a major architectural shift: the developers moved from a three-component framework consisting of a downloader, executor, and uploader to a…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | ns1.cloudlanecdn.com | High | Score 58/100 | First seen |
| MD5 | caf021dda726b8ba049c2aa395e505a1 | Medium | Score 53/100 | First seen |
| Domain | ns3.cloudlanecdn.com | High | Score 58/100 | First seen |
| Domain | ns2.cloudlanecdn.com | High | Score 58/100 | First seen |
| IP | 144.172.108.205 | High | Score 58/100 | First seen |
| Domain | clipeditskill.com | High | Score 58/100 | First seen |
| Domain | ns4.cloudlanecdn.com | Medium | Score 47/100 | First seen |
| MD5 | c092b02fbc0fdf7ee9608dd016673806 | Medium | Score 53/100 | First seen |
| IP | 216.126.237.197 | High | Score 58/100 | First seen |
| Domain | d.53466d4c67515a.0.p.cloudlanecdn.com | High | Score 58/100 | First seen |
| Domain | cloudlanecdn.com | High | Score 72/100 | First seen |
| MD5 | 29b2b8c5d99f05bfcdd0d8d976eb5678 | Medium | Score 53/100 | First seen |
| Domain | accesslinkssl.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…