Latest Threats

Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via SysAid RMM Abuse — Threadlinqs Intelligence

As of 2026-07-06, Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via SysAid RMM Abuse is a high-severity apt threat attributed to Cavern Manticore (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 48 indicators of compromise.

Threat ID: TL-2026-1137 · Severity: HIGH · Status: ACTIVE · Category: APT

Updated: 2026-07-06 · revalidated 1× · latest source

Attribution: Cavern Manticore · Iran · ESPIONAGE

Check Point Research disclosed Cavern Manticore, an Iran-nexus, MOIS-linked threat actor with technical overlaps to OilRig subgroup Lyceum and MuddyWater, deploying a modular .NET-based C2 framework

Cavern Manticore is an Iran-nexus advanced persistent threat cluster tracked by Check Point Research (CPR) since early 2026, assessed to be linked to Iran's Ministry of Intelligence and Security (MOIS) with technical and targeting overlaps to the OilRig subgroup Lyceum and to MuddyWater. The group's naming follows Check Point's 'Manticore' convention for Iran-aligned intrusion sets (cf. Educated Manticore, Nimbus Manticore, Scarred Manticore, Void Manticore). Cavern Manticore's primary victimology is Israeli government agencies and IT-sector organizations, with a distinctive tradecraft emphasis on multi-hop supply-chain compromise: the actor breaches IT providers/MSPs first and pivots through trusted administrative relationships to reach final government and enterprise targets. Initial access in the campaign centers on abuse of SysAid RMM/ITSM software's update feature to push a trojanized WinDirStat package. The legitimate WinDirStat.exe utility, deployed to C:\ProgramData\WinDir\WinDirStat.exe, is used to sideload a malicious uxtheme.dll (the 'Cavern Agent'). This DLL exports 83 functions that mimic the legitimate Windows theming library (uxtheme.dll), with the export EnableThemeDialogTexture (ordinal #20/0x14) repurposed as the true operational entry point — each export is a tiny native stub rather than a genuine theming function, a hallmark of the Mixed-Mode C++/CLI compilation format. The Cavern framework itself represents a significant evolution from the actor's earlier 'Cav3rn' toolset (a non-modular, single-DLL implementation that relied on steganographic PNG-based C2 transport using files with JPEG magic headers, e.g. .CvnC.png/.CvnA.png/.CvnR.png, and a webshell-style ASP.NET C2 handler named cac.aspx). The refactored Cavern framework is modular and deliberately compiled into three distinct .NET output formats specifically to frustrate reverse engineering: (1) standard .NET Framework IL-only modules (mhm.dll — file manager; db.dll — SQL Server browser; ode.dll — LDAP/Active Directory module) that retain full symbol metadata and are trivially decompilable with tools like ILSpy/dnSpyEx, sharing a common Command.Type enum with 61 distinct command IDs; (2) the Mixed-Mode C++/CLI Cavern Agent (uxtheme.dll) whose native stub exports require dual analysis with both a .NET decompiler and a native disassembler; and (3) NativeAOT .NET 8 modules (n-HTCommp.dll — communications; n-ten.dll — network reconnaissance; n-sws.dll — SOCKS5/WSS tunnel) that statically compile the entire .NET runtime into a single 3-6MB native PE with thousands of stripped framework functions, resolve P/Invoke APIs via runtime descriptor tables rather than the PE import table, and only materialize string literals at runtime from a 'hydrated' section rather than storing them as static strings. Operationally, the Cavern Agent communicates over HTTP (verbs get/send/cget/cpost/upload against /profile for polling and /gallery for result submission) using XOR (key 0x48) plus Base64 encoding of the request body, a fixed Microsoft Edge User-Agent string, and a custom X-User-token header combining the agent ID with a '00' suffix. The framework can pivot to WebSocket/WSS transport via a self-command (004) using verbs ws/getws/sendws/closews, with XOR applied to frames including the initial handshake. Custom field/argument delimiters (_;;_ and _,_) structure the protocol. Post-exploitation capability is extensive: file operations with DPAPI-protected credential decryption support; SQL Server enumeration, querying, and JSON-based data export; LDAP bind testing, AD user/group enumeration with paged searches (1,000-item pages) and configurable-delay brute-forcing; network reconnaissance (DNS resolution, interface enumeration, ping, netstat, port scanning); SMB credential brute-forcing; and a full SOCKS5-over-WebSocket/WSS tunneling capability supporting both server and client proxy modes. Anti-forensic design is a defining feature: each module loads inside a dedic

MITRE ATT&CK Techniques

T1195.002 Supply Chain Compromise; T1199 Trusted Relationship; T1574.002 Hijack Execution Flow; T1505.003 Server Software Component; T1574.002 Hijack Execution Flow; T1574.002 Hijack Execution Flow; T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1070.004 Indicator Removal; T1620 Reflective Code Loading; T1036.005 Masquerading; T1110 Brute Force; T1555 Credentials from Password Stores; T1087.002 Account Discovery; T1069.002 Permission Groups Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1021.002 Remote Services; T1570 Lateral Tool Transfer; T1213 Data from Information Repositories; T1005 Data from Local System; T1071.001 Application Layer Protocol; T1132.001 Data Encoding; T1008 Fallback Channels; T1572 Protocol Tunneling; T1090.001 Proxy; T1041 Exfiltration Over C2 Channel; T1583.001 Acquire Infrastructure; T1587.001 Develop Capabilities; T1583.006 Acquire Infrastructure; T1129 Shared Modules; T1106 Native API; T1569.002 System Services; T1204.002 User Execution; T1027.003 Obfuscated Files or Information; T1112 Modify Registry; T1187 Forced Authentication; T1069.001 Permission Groups Discovery; T1135 Network Share Discovery; T1016 System Network Configuration Discovery

Weaknesses (CWE)

CWE-427, CWE-506

Target sectors: government administration, informationtechnology, managedserviceproviders

Target regions: Middle East, israel

Update History

2026-07-06 — Iran-Linked Cavern Manticore Deploys New Modular Cavern C2 Framework Against Israeli Organizations: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and motivation (ESPIONAGE) are unchanged. The trigger research assigns attribution_confidence MEDIUM vs. the existing HIGH; this is a downgrade a

References

Detections & IOCs

As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 48 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

APT, HIGH, threat intelligence, cybersecurity, T1195.002, T1199, T1574.002, T1505.003, T1574.002, T1574.002, T1027, T1140, T1070.004, T1620

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison