Cavern Manticore: Iran-Linked Modular C2 Framework Analysis

Check Point Research has identified 'Cavern Manticore,' an Iranian Ministry of Intelligence and Security (MOIS)-linked threat actor, conducting operations against Israeli government and IT infrastructure. The group leverages a mature, modular C2 framework known as 'Cavern,' which shares significant technical and infrastructure overlaps with established Iranian actors such as MuddyWater and Lyceum (OilRig). The activity has been observed occurring alongside the military campaign 'Operation Epic Fury.'

The Cavern framework is notable for its sophisticated anti-analysis posture, utilizing three distinct .NET compilation formats—Standard IL, Mixed-Mode C++/CLI, and Native AOT—to complicate reverse engineering workflows. The execution chain typically initiates via DLL sideloading through legitimate applications like WinDirStat, often delivered by abusing existing Remote Monitoring and Management (RMM) software within target organizations to move laterally from IT providers to primary targets.

This campaign represents a significant threat to supply chain security, specifically targeting the trusted relationships between IT service providers and government entities. The use of specialized modules for DPAPI decryption, LDAP brute-forcing, and SQL manipulation indicates a high level of operational intent for credential theft and deep data exfiltration.