CYBER ESPIONAGE: Iranian Hackers Target Israeli Organizations Using Google Cloud Services

An Iranian cyber espionage operation targeting Israeli organizations has grown increasingly sophisticated, with attackers now use legitimate Google services to hide malicious communications, according to cybersecurity researchers at Kaspersky.

The campaign, designated Project CAV3RN, exploits Google Apps Script - a standard Google development and automation platform - to mask communications between compromised systems and attacker-controlled infrastructure. By channeling malicious traffic through a widely trusted Google service, the hackers can blend their activity with normal cloud operations, making detection by security systems more difficult.

Kaspersky researchers identified a recovery mechanism built into the attack infrastructure. If one communication channel is blocked, the malware can switch to an alternative channel and obtain a new address without requiring reinstallation on the infected computer.

The development signals a shift toward more complex attack infrastructure. Rather than simple designs, the campaign now employs a modular platform that enables attackers to add new capabilities, modify communication methods, and sustain long-term access to compromised systems.

Kaspersky also noted that comparable techniques using Microsoft Outlook and Microsoft Graph were discovered in July. The use of Google Apps Script show the attackers' ability to evolve their methods and highlight a growing challenge for Israeli organizations attempting to identify malicious activity concealed within routine cloud services.