Espionage crews keep landing on the same trick: relay command-and-control through a service the SOC already trusts. The latest is the CAV3RN framework (Kaspersky, targeting Israel). Its beacons now relay through Google Apps Script, so the C2 traffic just looks like ordinary requests to script.google.com. Before that, the same crew used Outlook calendar events. Classic living-off-trusted-sites: the domain's reputation is spotless, so it sails through most checks. We were curious what our own API would say about it. It resolves to google.com and comes back as a popular Top-50K domain, the kind of "known good" that tempts you to move on. The verdict we return is still investigate, with a note that a popularity ranking says nothing about what's actually running there. What gives CAV3RN away is the behavior around those requests, and the fact that the crew's real backend sits on plain rented VPN and proxy hosting. Source: Kaspersky Securelist. https://securelist.com/project-cav3rn-continues/120991/