Iran cyberattack malware supply chain MuddyWater

Iran's MOIS-Linked Hackers Deploy Modular C2 Framework Against Israeli Targets

12 July 2026

An Iranian hacking group called Cavern Manticore, linked to Iran's Ministry of Intelligence and Security, has been targeting Israeli IT providers and government organisations using a newly discovered modular command-and-control framework called Cavern. The framework exploits SysAid's software update feature to deploy a trojanised DLL, enabling capabilities such as file theft, database access, Active Directory reconnaissance, network scanning, and tunnelling, while using multiple .NET compilation formats to deliberately complicate reverse engineering and forensic analysis. The group has also been observed moving laterally through trusted IT supply chain relationships and abusing remote monitoring tools, with related Iranian threat actors simultaneously conducting broader reconnaissance and data exfiltration campaigns across the Middle East.

A hacking group tied to Iran's Ministry of Intelligence and Security has been running targeted intrusions against Israeli organisations using a previously unknown command-and-control framework. Researchers at Check Point have named both the framework and the threat actor: Cavern and Cavern Manticore respectively. The group shows tactical similarities with MuddyWater and Lyceum, the latter thought to be a subgroup of OilRig.

The primary targets have been IT providers and government entities. The choice of IT providers is deliberate: compromise one managed service provider and you potentially inherit access to everything they touch.

The Cavern framework is built on a shared .NET foundation but deliberately mixes compilation formats across its components, spanning standard .NET Framework, Mixed-Mode C++/CLI, and Native AOT (Ahead-of-Time) compilation. This isn't accidental variety. Using different compilation targets forces reverse engineers to switch toolsets mid-analysis and reconstruct metadata that would otherwise be straightforward to read. It's an anti-analysis technique baked into the architecture itself rather than bolted on as an afterthought.

The main agent, a trojanised uxtheme.dll, blends managed .NET code with native C++ in a single portable executable. It loads a separate communications module that phones home over HTTPS or WebSocket to a C2 server masquerading as a hospital infrastructure domain. From there, it pulls down additional modules as needed.

Five post-exploitation DLLs have been identified so far. One handles file operations and transfers. Another queries and exports SQL databases. A third does Active Directory reconnaissance including LDAP brute-force attempts. The fourth covers network scanning and SMB brute-force. The fifth provides SOCKS5 proxy and WebSocket tunnelling. Each module slots into the framework independently, meaning operators can deploy only what a particular target warrants without leaving unnecessary forensic traces.

The agent uses a built-in dispatcher to handle the two categories of module differently. Anything prefixed with "n-" gets loaded as a native DLL via the Windows LoadLibraryA API. Everything else is treated as a managed .NET assembly and loaded through AppDomain isolation, which adds another layer of compartmentalisation that complicates forensic analysis.

The initial foothold in documented attacks came through SysAid's software update mechanism. The attacker abused it to trigger a DLL side-loading chain that ultimately executed the Cavern Agent. From there, the intrusion followed a hop-and-pivot pattern: breach an IT provider, use that access to reach a second provider, then move through to the actual target. Remote Monitoring and Management tools already deployed in these environments made lateral movement considerably easier, and in some cases the group apparently used browser-based remote desktop features and remote printing functionality to exfiltrate data when more conventional clipboard or file-transfer methods were blocked.

This sits within a broader pattern of Iranian state-sponsored cyber activity that has intensified alongside the ongoing military conflict between Israel and the US against Iran. MuddyWater, a separate but related Iranian group, has been conducting reconnaissance across more than 12,000 internet-exposed systems, exploiting vulnerabilities in SmarterMail (CVE-2025-52691), n8n (CVE-2025-68613), N-central (CVE-2025-9316), Langflow (CVE-2025-34291), and Laravel Livewire (CVE-2025-54068).

That campaign has since moved past opportunistic scanning. Oasis Security reports confirmed data exfiltration from aviation, energy, and government sector targets across Egypt, Israel, and the UAE. The attack methods included vulnerability exploitation combined with Outlook Web Access brute-force attacks, supported by newly identified C2 infrastructure capable of handling multiple communication protocols.

The Cavern framework represents a notable step up in operational sophistication from what MOIS-affiliated groups have previously deployed publicly. Modular architecture, deliberate anti-analysis design choices, and systematic abuse of trusted service-provider relationships suggest a group that has had time to mature its tooling and is applying it with some patience.

READ NEXT

Nichirei Cyberattack Leaves Japan's Frozen Food Chain on Ice North Korean Hackers Are Quietly Poisoning Open Source Repositories GoSerpent Malware Has Been Quietly Raiding Southeast Asian Governments for Months