Cavern Manticore Modular .NET Command-and-Control Framework

Check Point Research has identified 'Cavern Manticore,' an Iran-nexus APT group linked to the Ministry of Intelligence and Security (MOIS), targeting Israeli government and IT organizations. The group shares technical overlaps with known entities MuddyWater and Lyceum, specifically utilizing a sophisticated, modular command-and-control framework built on a shared .NET foundation. This framework, active since early 2026, facilitates extensive post-exploitation activities including lateral movement and data exfiltration.

The threat actor employs a highly mature anti-analysis strategy by compiling framework components into three distinct formats: .NET Framework, Mixed-Mode C++/CLI, and .NET 8 NativeAOT. This approach forces security analysts to switch between multiple toolsets and effectively hides malicious logic from standard static analysis tools. Initial access is often achieved through the abuse of Remote Monitoring and Management (RMM) software or the exploitation of SysAid software updates to deliver sideloading packages.

This campaign represents a significant escalation in Iranian cyber capabilities, demonstrating a disciplined approach to supply-chain targeting. By compromising IT providers, Cavern Manticore leverages trusted relationships to reach high-value downstream targets. The use of custom, modular tools allows the adversary to maintain a low footprint while rapidly adapting their capabilities to specific victim environments.