Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via SysAid RMM Abuse

Cavern Manticore (TL-2026-1137), also tracked as Cav3rn C2 Framework, is a high-severity advanced persistent threat campaign, first published 2026-07-06. It is attributed to Cavern Manticore (Iran) with high confidence, affects SysAid SysAid RMM / ITSM On-Prem Platform, maps to 51 MITRE ATT&CK techniques (T1005, T1008, T1012), and is covered by 9 detection rules and 48 indicators of compromise.

Key facts for TL-2026-1137

Threat ID
TL-2026-1137
Also known as
Cav3rn C2 Framework, Operation Epic Fury cyber-espionage activity
Severity
HIGH
Status
ACTIVE
Category
APT
First published
2026-07-06
Last reviewed
2026-07-06
Attribution
Cavern Manticore
Attribution confidence
HIGH
Nation-state nexus
Iran
Motivation
ESPIONAGE
Target sectors
government administration, informationtechnology, managedserviceproviders
Target regions
Middle East, israel
Detection rules
9
Indicators of compromise
48
Updates
2026-07-06 · revalidated 1× · latest source

Malware and tooling in Cavern Manticore

Malware and tooling: WinDirStat

Check Point Research disclosed Cavern Manticore, an Iran-nexus, MOIS-linked threat actor with technical overlaps to OilRig subgroup Lyceum and MuddyWater, deploying a modular .NET-based C2 framework called Cavern (evolved from an earlier single-DLL 'Cav3rn' framework) against Israeli government and IT-sector organizations. Initial access involves abuse of SysAid RMM/ITSM software update mechanisms and multi-hop supply-chain compromise of IT providers, with active exploitation confirmed across multiple intrusions during the period of the U.S.-Israel 'Operation Epic Fury' military campaign against Iran.

How Cavern Manticore works

Cavern Manticore is an Iran-nexus advanced persistent threat cluster tracked by Check Point Research (CPR) since early 2026, assessed to be linked to Iran's Ministry of Intelligence and Security (MOIS) with technical and targeting overlaps to the OilRig subgroup Lyceum and to MuddyWater. The group's naming follows Check Point's 'Manticore' convention for Iran-aligned intrusion sets (cf. Educated Manticore, Nimbus Manticore, Scarred Manticore, Void Manticore). Cavern Manticore's primary victimology is Israeli government agencies and IT-sector organizations, with a distinctive tradecraft emphasis on multi-hop supply-chain compromise: the actor breaches IT providers/MSPs first and pivots through trusted administrative relationships to reach final government and enterprise targets.

Initial access in the campaign centers on abuse of SysAid RMM/ITSM software's update feature to push a trojanized WinDirStat package. The legitimate WinDirStat.exe utility, deployed to C:\ProgramData\WinDir\WinDirStat.exe, is used to sideload a malicious uxtheme.dll (the 'Cavern Agent'). This DLL exports 83 functions that mimic the legitimate Windows theming library (uxtheme.dll), with the export EnableThemeDialogTexture (ordinal #20/0x14) repurposed as the true operational entry point — each export is a tiny native stub rather than a genuine theming function, a hallmark of the Mixed-Mode C++/CLI compilation format.

The Cavern framework itself represents a significant evolution from the actor's earlier 'Cav3rn' toolset (a non-modular, single-DLL implementation that relied on steganographic PNG-based C2 transport using files with JPEG magic headers, e.g. .CvnC.png/.CvnA.png/.CvnR.png, and a webshell-style ASP.NET C2 handler named cac.aspx). The refactored Cavern framework is modular and deliberately compiled into three distinct .NET output formats specifically to frustrate reverse engineering: (1) standard .NET Framework IL-only modules (mhm.dll — file manager; db.dll — SQL Server browser; ode.dll — LDAP/Active Directory module) that retain full symbol metadata and are trivially decompilable with tools like ILSpy/dnSpyEx, sharing a common Command.Type enum with 61 distinct command IDs; (2) the Mixed-Mode C++/CLI Cavern Agent (uxtheme.dll) whose native stub exports require dual analysis with both a .NET decompiler and a native disassembler; and (3) NativeAOT .NET 8 modules (n-HTCommp.dll — communications; n-ten.dll — network reconnaissance; n-sws.dll — SOCKS5/WSS tunnel) that statically compile the entire .NET runtime into a single 3-6MB native PE with thousands of stripped framework functions, resolve P/Invoke APIs via runtime descriptor tables rather than the PE import table, and only materialize string literals at runtime from a 'hydrated' section rather than storing them as static strings.

Operationally, the Cavern Agent communicates over HTTP (verbs get/send/cget/cpost/upload against /profile for polling and /gallery for result submission) using XOR (key 0x48) plus Base64 encoding of the request body, a fixed Microsoft Edge User-Agent string, and a custom X-User-token header combining the agent ID with a '00' suffix. The framework can pivot to WebSocket/WSS transport via a self-command (004) using verbs ws/getws/sendws/closews, with XOR applied to frames including the initial handshake. Custom field/argument delimiters (_;;_ and _,_) structure the protocol. Post-exploitation capability is extensive: file operations with DPAPI-protected credential decryption support; SQL Server enumeration, querying, and JSON-based data export; LDAP bind testing, AD user/group enumeration with paged searches (1,000-item pages) and configurable-delay brute-forcing; network reconnaissance (DNS resolution, interface enumeration, ping, netstat, port scanning); SMB credential brute-forcing; and a full SOCKS5-over-WebSocket/WSS tunneling capability supporting both server and client proxy modes.

Anti-forensic design is a defining feature: each module loads inside a dedicated .NET AppDomain and is unloaded from memory after execution, startup routines enumerate and delete all files except the Communication Module, config.txt, and logs, and the agent supports hot-swap self-update (renaming its own DLL, loading the new version, and signaling completion via signalCode=200). Configuration is stored in config.txt (keys i, xd, int) with legacy Cav3rn variants using Cvn.cfg.A/Cvn.cfg.U for alive-time configuration, and command/result exchange occurring through inpt/outpt working directories. Persistence/execution artifacts include hardcoded mutex names MYMUTEX123HELLP, MYMUTEX123HELLP02, and MYMUTEX123HELLP04. The majority of observed samples score zero or very low detection rates on VirusTotal.

Infrastructure includes the domain hospitalinstallation[.]com (registered through Iranian hosting provider Fars Data) with subdomains auth.hospitalinstallation[.]com (older agent C2) and google.com.hospitalinstallation[.]com (newer agent C2, using a visual-obfuscation subdomain designed to resemble google.com at a glance), plus legacy Cav3rn HTTP-module endpoints on adserviceupdate[.]com and hygienehistory[.]com, both fronting the cac.aspx webshell-style C2 handler. A developer PDB path (C:\Users\rick\Desktop\Modules\cavern\) and human artifacts — frustrated developer error strings ('What is this sh*t?! where is get_version?!?', 'DLL not found...Maybe you didn't upload it!!!'), typos ('tunnel message receivecd', 'handeling connect ms'), and a malformed SQL query string — lead CPR to assess Cavern as human-authored, plausibly with AI assistance for routine code but shaped throughout by a single developer rather than generated end-to-end.

CPR's disclosure situates Cavern Manticore's cyber operations against Israeli government and IT-sector targets as running concurrently with the U.S.-Israel joint kinetic military campaign known as 'Operation Epic Fury' (opened February 28, 2026, kinetic phase concluding May 5, 2026) against Iranian leadership, missile infrastructure, and air defenses — indicating a cyber-espionage operation tempo disciplined and sustained through a period of active regional conflict. No CVE is cited by CPR for the SysAid abuse; the technique described is trust/update-mechanism abuse rather than exploitation of a specific unpatched vulnerability, though separately, unrelated XXE vulnerabilities in SysAid On-Prem (CVE-2025-2775, CVE-2025-2776) have previously been added to the CISA KEV catalog after being exploited in the wild by other threat actors, underscoring SysAid as a recurring target of MOIS-nexus operations against Israeli infrastructure providers (including prior MuddyWater activity).

MITRE ATT&CK techniques used in TL-2026-1137

Collection

T1005 Data from Local System; T1039 Data from Network Shared Drive; T1213 Data from Information Repositories; T1560.001 Archive via Utility

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1132.002 Non-Standard Encoding; T1571 Non-Standard Port; T1572 Protocol Tunneling

Discovery

T1012 Query Registry; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1069.001 Local Groups; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1124 System Time Discovery; T1135 Network Share Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel

Execution

T1106 Native API; T1129 Shared Modules; T1204.002 Malicious File; T1569.002 Service Execution

Credential Access

T1110 Brute Force; T1187 Forced Authentication; T1555 Credentials from Password Stores

defense-impairment

T1112 Modify Registry

Initial Access

T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1489 Service Stop

Persistence

T1505.003 Web Shell

stealth

T1574.001 DLL

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware

Affected products and versions in Cavern Manticore

  • SysAid — SysAid RMM / ITSM On-Prem Platform
    Vulnerable versions: Deployments with unverified/unsigned software-update packages
    Fixed in: N/A — supply-chain trust abuse of the update mechanism, not a specific patched vulnerability
  • Microsoft — Windows (WinDirStat DLL side-loading vector)
    Vulnerable versions: Windows endpoints running the bundled WinDirStat.exe utility
    Fixed in: N/A

Remediation for Cavern Manticore

Patches

  • Upgrade SysAid On-Prem deployments to 24.4.60 or later, which remediates the unrelated but co-located XXE vulnerabilities CVE-2025-2775 and CVE-2025-2776 previously exploited against SysAid infrastructure.
  • Apply SysAid vendor hardening guidance for the update/deployment feature and independently verify update package provenance/signatures rather than relying solely on the built-in mechanism.

Immediate actions

  • Block network communication to identified Cavern Manticore C2 infrastructure (hospitalinstallation.com and subdomains auth.hospitalinstallation.com / google.com.hospitalinstallation.com, adserviceupdate.com, hygienehistory.com) at perimeter firewalls, proxies, and DNS resolvers.
  • Hunt for WinDirStat.exe paired with a non-standard uxtheme.dll, especially outside C:\Windows\System32, and specifically at C:\ProgramData\WinDir\WinDirStat.exe; quarantine and forensically image any matches.
  • Audit SysAid RMM/ITSM server update logs, deployed software packages, and administrative sessions for unauthorized or unsigned update pushes and anomalous package delivery.
  • Sweep endpoints for mutexes MYMUTEX123HELLP, MYMUTEX123HELLP02, MYMUTEX123HELLP04 and for configuration artifacts config.txt, Cvn.cfg.A, Cvn.cfg.U, and inpt/outpt working directories in non-standard locations.
  • Hash-match environment binaries against the 14 published SHA-256 indicators for Cavern/Cav3rn modules (uxtheme.dll, n-HTCommp.dll, mhm.dll, db.dll, ode.dll, n-ten.dll, n-sws.dll).

Workarounds

  • Restrict SysAid server inbound/outbound connectivity to only required management endpoints pending investigation of update-channel integrity.
  • Temporarily disable the SysAid automatic software-update/deployment feature until package provenance can be independently verified.

Longer-term hardening

  • Deploy EDR with behavioral detection tuned for anomalous per-process .NET AppDomain creation/teardown and reflective or NativeAOT module loading patterns.
  • Implement application allowlisting/code-integrity policies to prevent unsigned or attacker-supplied DLLs from loading alongside trusted utilities such as WinDirStat.
  • Require code-signing verification and out-of-band integrity checks for all RMM/ITSM software update channels rather than trusting the vendor update mechanism implicitly.
  • Segment MSP/IT-provider administrative access from downstream customer and government networks to reduce blast radius from multi-hop supply-chain compromise.
  • Monitor for and alert on outbound WebSocket/WSS traffic and SOCKS5-style tunneling originating from endpoint/server assets that should not act as network proxies.

Weaknesses (CWE) in Cavern Manticore

CWE-427, CWE-506

Timeline of Cavern Manticore

  • Based on the identical ApiEx.* capability tree and Command.Type enum shared between legacy Cav3rn samples and the modular Cavern framework, CPR assesses the refactor from monolithic Cav3rn to modular Cavern began prior to early-2026 tracking. Date approximate; exact refactor date not disclosed by source.
  • Check Point Research traces the earliest observed Cavern Manticore activity to early 2026, using the non-modular 'Cav3rn' framework with steganographic PNG-based C2 transport and a cac.aspx webshell-style C2 handler.
  • CPR identifies and characterizes the older, monolithic Cav3rn generation — featuring steganographic JPEG-magic-prefixed PNG-based command/result exchange (.CvnC.png/.CvnA.png/.CvnR.png), inpt/outpt working directories, and adserviceupdate.com/hygienehistory.com C2 fronted by cac.aspx. Date approximate; exact first-seen not disclosed by source.
  • The U.S.-Israel joint military campaign 'Operation Epic Fury' against Iran begins, forming the geopolitical backdrop against which Cavern Manticore's cyber operations against Israeli targets are tracked.
  • Cavern Manticore observed abusing SysAid RMM/ITSM software update mechanisms to gain initial access into Israeli IT-provider and government networks via multi-hop supply-chain compromise, deploying a trojanized WinDirStat/uxtheme.dll package.
  • Trojanized uxtheme.dll Cavern Agent executes EnableThemeDialogTexture, loads n-HTCommp.dll, and establishes HTTPS/WebSocket C2 with hospitalinstallation.com subdomains; additional post-exploitation modules (mhm.dll, db.dll, ode.dll, n-ten.dll, n-sws.dll) are downloaded on demand as Base64+GZip blobs via the get_latest_dll hot-swap loader. Date approximate.
  • Attackers abuse the SysAid RMM/ITSM software update feature at a compromised first-hop IT service provider, pivot to a second-hop IT provider, then reach the ultimate Israeli government/defense/IT-sector target — weaponizing the trust relationship inherent to RMM/ITSM tooling across a deliberate two-hop supply-chain compromise. Date approximate.
  • The refactored, modular 'Cavern' C2 framework is observed in intrusions, introducing three distinct .NET compilation formats (IL-only, Mixed-Mode C++/CLI, NativeAOT) split across dedicated agent, communication, file-manager, SQL-browser, LDAP, network-recon, and tunnel modules.
  • A later Cavern Agent build (uxtheme.dll build 04) adds WebSocket (wss://) communication support, including self-commands for WebSocket activation, close, and reconnect. Date approximate; inferred from observed build progression.
  • CPR observes Cavern Manticore gaining access to defense and government-sector organizations with high operational tempo and disciplined target selection during the U.S.-Israel Operation Epic Fury military campaign. Date approximate.
  • The kinetic phase of Operation Epic Fury concludes; Cavern Manticore cyber-espionage activity against Israeli government and IT-sector targets continues to be tracked by Check Point Research.
  • Check Point Research develops custom NativeAOT reverse-engineering tooling ahead of publication: an IDA Pro plugin (ida-nativeaot, ported from Washi's ghidra-nativeaot) reconstructing .NET type system metadata from ReadyToRun tables, plus FLIRT signatures from a purpose-built .NET 8.0.25 NativeAOT coverage DLL, recovering ~60% of stripped function symbols across n-HTCommp.dll, n-ten.dll, and n-sws.dll. Date approximate.
  • Check Point Research confirms active exploitation of the Cavern framework across multiple confirmed intrusions into Israeli government and IT-sector organizations, with observed samples scoring zero or very low detection rates on VirusTotal.
  • CPR completes forensic attribution analysis, recovering developer PDB path C:\Users\rick\Desktop\Modules\cavern\, profane debug error strings, consistent typos, and the malformed SQL template — concluding the framework is human-authored and 'very plausibly built with some AI assistance for routine code, but driven and shaped throughout by a developer.' Date approximate.
  • The Hacker News and Infosecurity Magazine publish wire coverage of the Check Point Research findings, disseminating Cavern Manticore IOCs and TTPs to the broader security-practitioner community.
  • Threat ingested into the Threadlinqs hunt pipeline as TL-2026-1137 for MITRE ATT&CK mapping, IOC correlation, and detection-engineering coverage.
  • Check Point Research publicly discloses the Cavern Manticore threat actor and its modular C2 framework in 'Cavern Manticore: Exposing Iran-Linked Modular C2 Framework', including full IOC listings and MOIS/Lyceum/MuddyWater attribution analysis.

Update history for TL-2026-1137

Sources cited for Cavern Manticore

Threats related to Cavern Manticore

Detection coverage for TL-2026-1137

As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1137 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1137

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats