Check Point VPN Zero-Day, HTTP/2 Flaw, Notepad++ Plugin Abuse, and Certi-GHOST Exploit

Key Takeaways

• A malware component, part of the Project CAV3RN framework, is using future-dated Microsoft Outlook calendar events as a covert command-and-control channel.
• This sophisticated method targets Israeli organizations, with a low-confidence attribution to the Iranian-linked OilRig group.
• A critical heap-based buffer overflow vulnerability (CVE-2026-14266) has been discovered in 7-Zip, allowing remote code execution through specially crafted archives.
• Users of 7-Zip are strongly advised to update to version 26.02 immediately to patch this flaw.

Covert C2: Malware Hides Commands in Outlook Calendar Events Dated 2050

Cybersecurity researchers at Kaspersky have uncovered a novel command-and-control (C2) mechanism employed by a malware component associated with the Project CAV3RN framework. This sophisticated module, named AzureCommunication.dll, leverages Microsoft Outlook calendar events scheduled for May 13, 2050, to discreetly exchange commands and data with compromised systems. The campaign, which has a low-confidence nexus to the Iranian-backed OilRig threat actor, primarily targets organizations within Israel.

The malware achieves its covert communication by authenticating to Microsoft Entra ID (formerly Azure Active Directory) using OAuth 2.0. It then utilizes a compromised Microsoft 365 mailbox’s calendar as a two-way “dead-drop” channel. This technique allows malicious traffic to blend seamlessly with legitimate calendar activity, making detection significantly more challenging for defenders.

Commands transmitted through this channel are secured using a hybrid encryption scheme involving RSA and AES-256-GCM. Should direct access to the Microsoft Graph API fail, the malware incorporates a robust fallback mechanism: DNS tunneling over IPv6 AAAA records. This alternative ensures that the malware can restore its credentials without requiring the redeployment of new payloads. Defenders are advised to scrutinize Microsoft 365 audit logs for any calendar events scheduled far into the future and to monitor DNS AAAA queries directed at suspicious infrastructure, such as cloudlanecdn[.]com.

Critical 7-Zip Vulnerability Enables Remote Code Execution

A significant security flaw, tracked as CVE-2026-14266, has been identified in the widely used file archiver, 7-Zip. This vulnerability, a heap-based buffer overflow, stems from the software’s improper handling of XZ chunked data. Exploitation can occur when a user opens a maliciously crafted archive or visits a website designed to deliver the payload.

While successful exploitation requires user interaction, the vulnerability allows attackers to execute arbitrary code with the privileges of the logged-in user. This makes it a highly weaponizable flaw, particularly through phishing campaigns that distribute malicious attachments, which could lead to malware delivery or ransomware staging.

Landon Peng of Lunbun LLC reported this critical vulnerability through the Zero Day Initiative. Fortunately, a patch is available, with the issue being resolved in 7-Zip version 26.02. Users are strongly encouraged to update their installations immediately. Furthermore, it is recommended to exercise caution when opening archives from untrusted sources and to enable robust email attachment scanning to intercept malicious compressed files before they reach end-users.

This week’s security insights highlight a persistent challenge in the cybersecurity landscape: the convergence of legacy code vulnerabilities and advanced, often AI-driven, offensive techniques. Even mature and extensively audited software can harbor critical flaws for years, as evidenced by the 15-year-old NGINX RCE chain and the 2017-era RefluXFS kernel bug. These revelations underscore the critical importance of a rigorous patch cadence and proactive fuzzing, regardless of a software’s age or perceived robustness.

What You Should Do

• For 7-Zip Users: Immediately update 7-Zip to version 26.02 to patch CVE-2026-14266. Avoid opening compressed archives from unknown or untrusted sources. Enhance email security measures to scan and block malicious attachments.
• For Microsoft 365 Defenders: Review Microsoft 365 audit logs for calendar events scheduled unusually far into the future (e.g., May 13, 2050). Monitor DNS AAAA queries for suspicious domains, particularly those associated with cloudlanecdn[.]com. Implement strict access controls for Microsoft Entra ID and regularly audit OAuth 2.0 application permissions.
• General Best Practices: Maintain a strong patch management program across all software and systems. Educate users about phishing risks and the dangers of opening unsolicited attachments. Deploy robust endpoint detection and response (EDR) solutions to identify anomalous activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.