Iran-Linked Hackers Deploy New Cavern C2 Framework in Targeted Attacks on Israeli Organizations

Iranian state-sponsored hackers affiliated with the Ministry of Intelligence and Security (MOIS) have been using a previously undocumented modular command-and-control (C2) framework named Cavern (aka Cav3rn) to target Israeli organizations, primarily IT providers and government sectors. The activity is attributed to a threat cluster tracked by Check Point Research as Cavern Manticore, which shares tactical overlaps with MuddyWater and Lyceum (a subgroup within OilRig).

The Cavern framework is built on a shared .NET foundation and uses multiple compilation formats, including .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT, to complicate reverse engineering. The attack chain begins with a DLL side-loading attack via SysAid’s software update feature, leading to execution of a trojanized DLL (uxtheme.dll) containing the Cavern Agent. The agent loads a communication DLL (n-HTCommp.dll) to contact the C2 server and fetch post-exploitation modules over HTTPS or WebSocket.

Five DLL modules have been identified: mhm.dll (file operations), db.dll (SQL database enumeration), ode.dll (Active Directory reconnaissance), n-ten.dll (network reconnaissance), and n-sws.dll (SOCKS5 proxy and WebSocket tunneling). The framework uses AppDomain isolation for anti-forensics and forces analysts into multiple toolchains.

Cavern Manticore has moved from an initial compromised IT provider to a second-hop provider before reaching the final target, weaponizing trusted relationships in the software supply chain. Separately, MuddyWater has conducted a broad reconnaissance campaign exploiting vulnerabilities in SmarterMail (CVE-2025-52691), n8n (CVE-2025-68613), N-central (CVE-2025-9316), Langflow (CVE-2025-34291), and Laravel Livewire (CVE-2025-54068), targeting aviation, energy, and government sectors in Egypt, Israel, and the UAE.