Project CAV3RN, an ongoing campaign targeting Israel, has evolved to use Google Apps Script as C2 relays and DNS-based routing for C2 channel selection. The modular .NET NativeAOT framework employed by the threat actor blends C2 traffic with legitimate Google services, making detection more challenging. This sophisticated approach demonstrates an effort to evade traditional security measures.