Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN is a sophisticated, modular espionage framework observed targeting Israel that uses DLL components coordinated by a local broker and a multi-transport C2 supporting direct HTTPS and a Google Apps Script relay. The report documents GoogleService.dll and rnp.dll internals, DNS-based control-plane logic that chooses C2 channels and recovers Google deployment IDs via chunked DNS responses, configuration and reporting formats (XOR+Base64), observed infrastructure (studiotikva.com and related IPs), file hashes, and operational tradecraft that enable stealthy, resilient command-and-control and in-place component upgrades.