Cavern is a modular backdoor framework documented by Check Point, attributed to an Iranian Ministry of Intelligence and Security-linked actor called Cavern Manticore, with overlaps to MuddyWater and Lyceum. Group-IB links HollowGraph to Cavern with high confidence based on shared command syntax and tasking.