Reported by 1 outlet

Timeline

1. original reporting

   Cavern Manticore: Iran MOIS Deploys Modular "Cavern" C2 Framework Against Israeli IT Providers

   thehackernews.com · 98d ago · July 8th, 2026

   Check Point Research has disclosed a new Iran-linked APT cluster, Cavern Manticore, affiliated with Iran's Ministry of Intelligence and Security (MOIS), deploying a previously undocumented modular C2 framework called Cavern (aka Cav3rn). The group shares tactical overlap with MuddyWater and Lyceum (assessed as a subgroup of OilRig).

   The attack chain exploits SysAid's software update feature for DLL side-loading, deploying a trojanized uxtheme.dll containing the Cavern Agent. The agent then fetches five post-exploitation DLL modules over HTTPS/WebSocket from hospitalinstallation[.]com:

   • mhm.dll — File operations, recursive search, archive handling, bidirectional transfer

   • db.dll — SQL database enumeration, query, export, manipulation

   • ode.dll — Active Directory reconnaissance, user/group enumeration, LDAP brute-force

   • n-ten.dll — Network reconnaissance, port scanning, SMB brute-force

   • n-sws.dll — SOCKS5 proxy and WebSocket tunneling

   Notably, Cavern Manticore chains trusted IT provider relationships — compromising an initial IT services company, pivoting to a second-hop provider, then reaching the intended target. The actor abuses RMM tools and browser-based remote desktop (leveraging features like remote printing to exfiltrate data when clipboard and file-transfer controls are blocked). The framework uses three .NET compilation formats (.NET Framework, Mixed-Mode C++/CLI, and Native AOT) as an anti-analysis measure, with per-module AppDomain isolation for anti-forensics.

   Hunting hypothesis: An attacker exploits a SysAid software update mechanism to side-load a trojanized DLL, then uses the Cavern C2 framework to pivot through IT service providers into target networks via compromised RMM tools.

   Recommended action: Hunt for SysAid DLL side-loading indicators. Audit RMM tool access logs for lateral movement between customer environments. Monitor for C2 domain hospitalinstallation[.]com and related IoCs.

   ---