An Iranian hacking group linked to MOIS has been using the modular Cavern (Cav3rn) C2 framework to target Israeli organizations, especially IT providers and government sectors. The campaign uses trojanized SysAid updates, DLL side-loading, and multiple anti-analysis .NET components to enable reconnaissance, lateral movement, and data theft. #Cavern #Cav3rn #CavernManticore #MuddyWater...

At a Glance Actor or group: Cavern Manticore APT (suspected Iran-linked) Activity type: Cyber-espionage and network infiltration Targets or victims: Israeli government and IT sectors Scale: Multiple supply-chain intrusions Jurisdiction or law-enforcement status: Active investigation Source: Check Point Research (CPR) TL;DR Security analysts discovered a new campaign by the suspected Cavern Manticore APT. These attackers deploy a highly adaptable modular C2 framework to breach Israeli networks.

Iranian hackers have transformed ubiquitous system administration tools into clandestine pathways for infiltrating highly secure networks. The threat actor known as Cavern Manticore leverages a novel, modular framework dubbed "Cavern." They orchestrate sophisticated cyberattacks against Israeli governmental institutions and prominent IT enterprises, as revealed by cybersecurity experts at Check Point. In select instances, these malicious operators systematically breached IT service providers first.

Check Point Research tracked Cavern Manticore, an Iran-nexus threat actor targeting Israeli government and IT organizations using a modular .NET C2 framework with strong anti-analysis features and RMM abuse for initial access. The report also details related infrastructure, legacy Cav3rn samples, and multiple post-exploitation modules for reconnaissance, file access, LDAP, SQL, networking, and tunneling. #CavernManticore #MuddyWater #Lyceum #SysAid #uxtheme.dll #n-HTCommp.dll