Cavern uses DNS A records to switch between direct HTTPS and Google Apps Script for C2, expanding an Iranian-linked toolkit ...