Project CAV3RN (internally "Cav3rn"/"Cavern") is a modular cyberespionage framework that Kaspersky has tracked since December 2025 and that Check Point Research independently tracks under the name "Cavern Manticore." The framework evolved from a monolithic Cav3rn-era agent using steganographic PNG-based transport and a WebShell command handler into a controller-based architecture (observed by April 2026) built around a persistent controller component, uxtheme.dll (the "Cavern Agent"), which manages an Agent ID, a polling loop, and command routing, and which loads swappable native communication and post-exploitation plugin modules.

Initial access in the Cavern Manticore intrusions leverages abuse of the SysAid IT service-management software's update feature to deliver a DLL sideloading chain: a legitimate loader is abused to load the trojanized uxtheme.dll (Cavern Agent), which in turn loads the native communication module n-HTCommp.dll for HTTPS/WebSocket-based C2 connectivity. Deliberate compilation-format diversity across the .NET Framework (IL-only, symbol-rich), Mixed-Mode C++/CLI, and .NET 8 Native AOT (fully native, metadata-stripped) forms is used as an explicit anti-analysis strategy, forcing defenders to switch reverse-engineering toolchains between modules; per-module AppDomain isolation further limits in-memory artifact recovery, and NativeAOT runtime descriptors hide P/Invoke API imports from standard import-table analysis.

The most recent and most novel module, AzureCommunication.dll, replaces the legacy n-HTCommp.dll HTTP/WebSocket channel with a covert channel built entirely on legitimate Microsoft 365 services. Compiled with .NET Native AOT (single exported function QueryInterface, accepting a null-terminated UTF-16 command string in the form get_;;_<agent-id>_,_<legacy-url> or send_;;_<agent-id>_,_<legacy-url>_,_<result>), the module stores its configuration in a file named logAzure.txt containing a hardcoded Microsoft Entra tenant ID, application (client) credentials, the target mailbox address, a DNS bootstrap hostname, and an embedded RSA key pair. Using the Microsoft Graph API against a compromised Israeli law-firm Microsoft 365 mailbox, the module creates and reads calendar events that function as an asynchronous C2 dead-drop: all events are scheduled inside a single fixed one-hour window (2050-05-13 22:00-23:00 UTC) far in the future so they never surface in a normal calendar view. Event subjects encode message type and agent identity: "Event ID: <agent-id>" carries operator-to-agent commands, "Boss update ID: <agent-id>1500" is an agent heartbeat, and "Boss Report ID: <agent-id>1500" carries agent-to-operator results. Command payloads embedded in event bodies are protected with RSA-OAEP-SHA256 (256-byte key-transport block) wrapping an AES-256-GCM-encrypted body; the implant decrypts using its embedded RSA private key and re-encrypts results before writing its own calendar event.

When Microsoft Graph authentication fails (e.g., revoked application credentials or blocked tenant), AzureCommunication.dll falls back to a DNS AAAA-based configuration-recovery channel against the actor-registered domain cloudlanecdn[.]com (registered 2025-12-24; delegated to dedicated nameservers ns1-ns4.cloudlanecdn[.]com on 2026-05-02). Agent IDs are converted to uppercase hexadecimal (e.g., SFmLgQZ -> 53466D4C67515A) and embedded into subdomain labels. A length query of the form d.<hex-agent-id>.<field-index>.p.<host> returns the size of a requested configuration field (TenantId, ClientId, ClientSecret, or UserEmail) encoded in bytes 2-3 of the returned AAAA (IPv6) address; the module then issues sequential data queries of the form d.<hex-agent-id>.<field-index>.<offset>.q.<host>, each returning a 14-byte chunk of the field value embedded in the AAAA response bytes, until the full value is reassembled. A sentinel response of 2001:4998:44:3507::8000 signals that no data is currently available for that query, allowing the implant to retry. This mechanism lets the operators silently rotate compromised Entra application credentials for the primary channel without needing a working authenticated session.

Check Point's overlapping "Cavern Manticore" reporting documents a broader plugin family alongside the Cavern Agent and communication modules: mhm.dll (file-manager, including DPAPI blob decryption), db.dll (SQL Server/database browsing and querying), ode.dll (LDAP/Active Directory reconnaissance and brute-forcing), n-ten.dll (network reconnaissance, port scanning, SMB brute-forcing), and n-sws.dll (SOCKS5 proxying and WebSocket protocol tunneling for pivoting into internal networks). The framework implements a command-ID taxonomy of roughly 60 numbered operator commands spanning agent self-management, host/token/DPAPI info gathering, SQL operations, file/directory manipulation, LDAP/AD enumeration and brute force, process/registry/service management (present in code but not deployed in the current modular build), archive/compression, network reconnaissance (DNS, interfaces, ping, ARP, port scan), SMB operations, and local/domain user and group enumeration -- consistent with an operational focus on credential harvesting, internal reconnaissance, and lateral movement following an initial IT-provider or professional-services foothold. Debug artifacts (a PDB path referencing a developer alias, English-language error strings with informal phrasing and typos) indicate hands-on human development, in some cases alongside apparent AI-assisted boilerplate.

Victimology centers on Israeli organizations -- specifically law firms and human-resources companies in the Kaspersky-documented AzureCommunication.dll intrusion, and IT service providers, government bodies, and defense contractors in the broader Cavern Manticore reporting, consistent with a supply-chain strategy of compromising IT/MSP infrastructure as a first-hop pivot into higher-value downstream government and defense targets; related reporting also references a wider Middle East footprint (aviation, energy, and public-sector targeting extending to Egypt and the UAE). Attribution to Iran's Ministry of Intelligence and Security (MOIS)-linked activity is assessed at low-to-medium confidence, based on: use of trusted Microsoft-hosted services for C2 (paralleling known OilRig/APT34 tradecraft such as RDAT's use of Exchange Web Services and OilCheck's use of Microsoft Graph), a DNS-based secondary/fallback recovery channel for configuration data (paralleling OilBooster's HTTP-based token-recovery mechanism and OilRig's long history of DNS tunneling), targeting overlap and TTP overlap with MuddyWater and Lyceum (assessed as an OilRig/APT34 subgroup), and the abuse of compromised regional (Israeli) infrastructure consistent with prior OilRig-linked Solar and Whisper/Veaty malware activity. No CVE or exploited software vulnerability underlies this campaign; the SysAid abuse described in overlapping reporting is a feature/update-mechanism abuse rather than a documented CVE, and the framework's initial access relies on supply-chain/IT-provider trust abuse rather than a specific unpatched flaw.