Iranian Spy Campaign Against Israel Adapts Using Google Cloud Services

Researchers at Kaspersky have revealed that the Iranian espionage campaign known as Project CAV3RN, targeting Israeli organizations, is evolving by incorporating Google Cloud services into its operations. The attackers now exploit Google Apps Script, a legitimate Google service used for automation and development, to mask communications between infected computers and their command systems. This technique allows malicious traffic to blend in with normal activity on trusted Google platforms, complicating detection by security systems.

Kaspersky's analysis highlights that the attack infrastructure includes a recovery mechanism enabling the malware to switch to alternative communication channels and obtain new addresses if the primary channel is blocked, without requiring reinstallation. This reflects a broader trend of moving from simple attack infrastructures to modular platforms that allow attackers to add capabilities, change communication methods, and maintain prolonged access to victim systems.

The company also notes that in July, similar tactics were observed using Microsoft Outlook and Microsoft Graph services. The recent shift to Google Apps Script demonstrates the attackers' high adaptability and underscores the increasing challenge Israeli organizations face in identifying cyberattacks concealed within everyday cloud services.