The Hacker News17%
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations 17%
By Ravie Lakshmanan12%
7/6/2026, 11:34:26 AM
BS Summary: This article contains 16 faulty reasoning types, including Post Hoc (False Cause), Unattributed Quote, and Representativeness Heuristic, with Appeal to Authority as the most egregious example at 25.9% saturation with 210 hits. Analysis detected 1,207 faulty-reasoning hits from 810 analyzed words, generating a BS Score of 32.8% and a BS Rank of 17% (18,173 of 21,887 articles). This article is better (less manipulative) than 83.00% of the article peer group.
An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations.
The activity, which has primarily singled out IT providers and government sectors, has been attributed to a threat cluster tracked by Check Point Research under the moniker <b>Cavern Manticore</b>, which it said shares some level of tactical overlaps with MuddyWater and Lyceum, the latter of which is assessed to be a subgroup within OilRig.
"The framework reflects a mature and adaptable toolset built around a shared .
NET foundation, while using multiple compilation formats across different components, including .
NET Framework, .
NET Mixed-Mode C++/CLI, and .
NET Native AOT," the cybersecurity company said.
"The compilation format itself becomes the anti-analysis layer that forces reverse engineers into multiple toolsets and metadata-reconstruction workflows."
The components of the C2 framework are used as Cavern Agent and Cavern modules, demonstrating a clear division of responsibilities between core communication capabilities and mission-specific post-exploitation functionality.
This architecture has inherent advantages as it allows the operators to tailor deployments based on the victim profile, reduce forensic visibility, and ensure persistent access through bespoke modules for reconnaissance, data theft, tunneling, and lateral movement.
The attack chain documented by Check Point Research commences with SysAid's software update feature, which is leveraged by the adversary to initiate a DLL side-loading chain that leads to the execution of a trojanized DLL ("uxtheme.dll") containing the Cavern Agent.
The agent, for its part, loads a standalone communication DLL module ("n-HTCommp.dll") to contact the C2 server ("hospitalinstallation[.]com") and fetch additional post-exploitation modules on the fly over HTTPS or WebSocket.
As many as five DLL modules have been uncovered -
<ul>
<li><b>mhm.dll</b>, for file operations, enumeration, recursive file search, archive handling, and bidirectional file transfer</li>
<li><b>db.dll</b>, for SQL database enumeration, query, export, and manipulation</li>
<li><b>ode.dll</b>, for Active Directory reconnaissance, user/group enumeration, and LDAP brute-force attempts</li>
<li><b>n-ten.dll</b>, for network reconnaissance, port scanning, share enumeration, and SMB brute-force attempts</li>
<li><b>n-sws.dll</b>, for SOCKS5 proxy and WebSocket tunneling</li>
</ul>
A defining trait of the framework is its use of three different .
NET compilation targets spanning its components: while mhm.dll, db.dll, and ode.dll are pure .
NET Framework modules, n-HTCommp.dll, n-ten.dll, and n-sws.dll make use of Native AOT (Ahead-of-Time) compilation.
The main agent, uxtheme.dll, combines managed .
NET code with native C++ in a single portable executable.
Embedded within the agent is a unified module dispatcher that treats components whose names start with n- as native DLLs and loaded via the LoadLibraryA Windows API, while the rest is interpreted as managed .
NET assemblies and loaded through a mechanism known as AppDomain isolation.
"The framework's anti-analysis posture relies on uncommon .
NET compilation formats (Mixed-Mode C++/CLI and Native AOT) that force reverse engineers into multiple toolsets and metadata-reconstruction workflows, together with per-module AppDomain isolation as an anti-forensics measure," Check Point explained.
Attacks orchestrated by Cavern Manticore have involved the threat actor moving from an initial compromised IT provider to a second-hop provider before ultimately reaching the intended target organization, indicating their ability to weaponize trusted relationships in the software supply chain to their advantage.
"This activity highlights the operational value of trusted service-provider relationships, particularly where Remote Monitoring and Management (RMM) solutions are deployed," the company noted.
"By abusing these tools, the actor can move laterally between victims and deliver malicious software disguised as legitimate updates.
The actor also appears to leverage browser-based remote desktop technologies to access targets of interest and, in some cases, abuse built-in features such as remote printing to exfiltrate data when clipboard-based copy-paste or file-transfer capabilities are restricted."
The development unfolds against the backdrop of the ongoing joint military operation launched by Israel and the U.S. against Iran.
In recent months, the Iranian state-sponsored threat actor tracked as MuddyWater has been observed conducting a broad reconnaissance campaign across more than 12,000 internet-exposed systems by exploiting known security flaws in internet-exposed SmarterMail, n8n, N-central, Langflow, and Laravel Livewire systems.
The list of exploited vulnerabilities is as follows -
<ul>
<li><b>CVE-2025-52691</b> - SmarterMail remote code execution vulnerability</li>
<li><b>CVE-2025-68613</b> - n8n remote code execution vulnerability</li>
<li><b>CVE-2025-9316</b> - N-Central unauthenticated sessionID generation vulnerability</li>
<li><b>CVE-2025-34291</b> - Langflow remote code execution vulnerability</li>
<li><b>CVE-2025-54068</b> - Laravel Livewire remote code execution vulnerability</li>
</ul>
The operation is said to have pivoted from broad reconnaissance to targeted credential harvesting and data exfiltration attacks against aviation, energy, and government sectors in the Middle East, including aviation, energy, and public sector entities in Egypt, Israel, and the United Arab Emirates.
"The operation leveraged a combination of vulnerability exploitation, Outlook Web Access (OWA) brute-force attacks, and newly identified command-and-control (C2) controllers supporting multi-protocol communication," Oasis Security said.
"The activity progressed beyond reconnaissance and access attempts, resulting in confirmed exfiltration of sensitive data from compromised environments."
Speakers
2speakers6.9%attributed speech754writer words
Voice mapSelect a segment to jump to its words
Selected voice
100%flagged-word coverageCheck Point Research
30 attributed words54% of attributed speech78% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.