Threat Advisory • Actor Report • TA2026193

Meet Cavern Manticore: Iran's Invisible New Espionage Actor

Cavern Manticore is a newly identified Iran-linked espionage actor, tied to Iran's Ministry of Intelligence and Security (MOIS), that has emerged in early 2026 targeting Israeli IT service providers, government agencies, and defense organizations. The group operates a modular .NET command-and-control framework called Cavern (also seen as Cav3rn), delivered through DLL side-loading, and has so far evaded public sandboxes and antivirus engines with near-zero detection rates.

Section 01

Summary

Cavern Manticore is a newly tracked Iran-linked espionage actor first seen in early 2026, targeting Israel across the IT service providers, government, and defense industries on the Windows platform. The threat actor's primary tooling is Cavern (also known as Cav3rn or CAV3RN), a modular command-and-control framework built on .NET and compiled across multiple runtime formats to complicate reverse engineering.

Cavern Manticore's targeted products span Remote Monitoring and Management (RMM) tooling, browser-based remote desktop technologies, Active Directory, LDAP, SMB, and Microsoft IIS. The actor abuses trusted IT service provider relationships and DLL side-loading to gain initial access, then leverages the Cavern framework for lateral movement, credential theft, and command-and-control, ultimately exfiltrating data over the same C2 channel used for tasking.

---

Section 02

Actor Details

#1 — Origins and Targeting of Cavern Manticore

Cavern Manticore is an Iran-linked hacking group tied to Iran's Ministry of Intelligence and Security (MOIS). It appeared in early 2026 and has focused on Israeli IT service providers, government agencies, and defense-related organizations, activity that lines up with the ongoing joint U.S.-Israel military operation against Iran.

#2 — MOIS Attribution Through Infrastructure and Tradecraft Overlaps

The MOIS attribution is based on overlaps with two known Iranian groups, MuddyWater and Lyceum (a subgroup of OilRig), and on infrastructure clues: the main C2 domain was registered through Fars Data, an Iranian hosting provider, and the C2 traffic patterns match Lyceum's older tradecraft of victim-side proxying and XOR obfuscation.

#3 — The Cavern Framework: A Deliberately Fragmented .NET Toolkit

The group's toolkit is a new modular framework called Cavern (also seen as Cav3rn). It is built on .NET, but its parts are compiled in three different formats: standard .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT. This mix is deliberate: it slows down reverse engineers by forcing them to switch between multiple analysis tools. For initial access, the group abuses trusted IT service providers, hopping from one provider to another before reaching the real target.

#4 — Initial Access via SysAid Abuse and DLL Side-Loading

From there, they trigger the SysAid software update feature to launch a DLL side-loading chain: the legitimate WinDirStat.exe loads a malicious uxtheme.dll, which is the Cavern Agent. When SysAid isn't the entry point, they use RMM tools or browser-based remote desktop features to drop the same agent instead. Once installed, the Cavern Agent loads a native communication module that reaches the C2 server at hospitalinstallation[.]com over HTTPS or WebSocket and pulls down more modules as needed.

#5 — Lateral Movement, Credential Theft, and Covert C2 Channels

For lateral movement, the group relies on the same RMM channels used for initial access along with RDP, and reaches internal hosts through the SOCKS5 and WebSocket tunnels built into n-sws.dll. Credentials are stolen through LSASS memory dumps and the LDAP/SMB brute-force modules. C2 traffic is routed through ASP.NET webshell handlers (cac.aspx) on separate IIS servers, hidden with XOR obfuscation and Base64 encoding, with each backdoor using a fixed set of HTTP verbs to look like normal web traffic.

#6 — Exfiltration and Near-Zero Detection

Data is exfiltrated over the same C2 channel; when clipboard and file-transfer paths are blocked, the actor has abused Windows remote printing to smuggle data out instead. Cavern samples currently show zero or near-zero detections on public sandboxes and antivirus engines, and the modular design means finding one piece doesn't expose the rest, which is what lets the group run long, quiet espionage campaigns against high-value targets.

---

Section 03

Actor Group

---

Section 04

Recommendations

---

Section 05

Potential MITRE ATT&CK TTPs

---

Section 06

Indicators of Compromise (IOCs)

---

Section 07

References

• https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/