An Iranian hacking group called Cavern Manticore, linked to Iran's Ministry of Intelligence and Security, has been targeting Israeli IT providers and government organisations using a newly discovered modular command-and-control framework called Cavern. The framework exploits SysAid's software update feature to deploy a trojanised DLL, enabling capabilities such as file theft, database access, Active Directory reconnaissance, network scanning, and tunnelling, while using multiple .NET compilation formats to deliberately complicate reverse engineering and forensic analysis. The group has also been observed moving laterally through trusted IT supply chain relationships and abusing remote monitoring tools, with related Iranian threat actors simultaneously conducting broader reconnaissance and data exfiltration campaigns across the Middle East.
