Full Report
Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the
Analysis Summary
# Threat Actor: Cavern Manticore
## Attribution & Identity
* **Identification:** An Iranian nation-state hacking group affiliated with the Ministry of Intelligence and Security (MOIS).
* **Aliases/Associations:**
* **Cav3rn** (alternate spelling).
* **Overlaps:** MuddyWater and Lyceum (an OilRig sub-group).
* **Potential Links:** Kaspersky associates this activity with **OilRig** (APT34) with low confidence based on behavioral similarities.
## Activity Summary
Researchers have tracked the evolution of the **Cavern C2** framework since December 2025. In early 2026, the framework shifted to a modular architecture. Recent campaigns in mid-2026 (June–August) have focused on entities in Israel, utilizing novel communication modules that leverage legitimate cloud services like Microsoft 365 and Google Apps Script to bypass detection.
## Tactics, Techniques & Procedures
* **Dead-Drop Resolver:** Uses Microsoft 365 calendar events as a C2 channel; tasks are planted as events dated far into the future (e.g., May 13, 2050).
* **DNS Tunneling:** Employs DNS A-record responses to toggle between HTTPS and Google Apps Script relays and to refresh Microsoft Entra ID (Azure AD) OAuth tokens.
* **NativeAOT Compilation:** Use of .NET NativeAOT-compiled DLLs (e.g., HOLLOWGRAPH) to complicate reverse engineering.
* **Cloud Misuse:** Abuses Microsoft Graph API for exfiltration and Google Apps Script for traffic relaying.
* **Modular Persistence:** Use of a broker ("rnp.dll") to load/unload plugin-based modules for specific post-exploitation tasks.
* **Lateral Movement/Recon:** Modules designed for SQL database enumeration, Active Directory reconnaissance, and LDAP brute-force attacks.
## Targeting
* **Sectors:** Entities related to Government, Infrastructure, and likely any sector relevant to Iranian intelligence interests.
* **Geography:** Primarily **Israel**.
* **Victims:** Specific organizations were not named, but the actor is known to use compromised infrastructure from entities within the targeted regions to host their backend.
## Tools & Infrastructure
* **Malware Families:**
* **Cavern C2:** Main framework (Agent and assorted modules).
* **HOLLOWGRAPH:** A .NET DLL used for Microsoft 365 calendar-based C2.
* **GoogleService.dll:** Communication module for Google Apps Script relay.
* **rnp.dll:** An inter-component broker for framework management.
* **Infrastructure:**
* **C2 Channels:** Microsoft Graph API, Google Apps Script, DNS A-records.
* **Domains/IPs:** The article mentions the use of "conf.json" for local configuration. (Specific IPs/URLs were not provided in the text, but the actor uses legitimate `graph.microsoft[.]com` and `script.google[.]com` endpoints).
## Implications
Cavern Manticore’s shift toward "Living off the Cloud" (LotC) techniques signifies a sophisticated attempt to blend into legitimate enterprise traffic. By using Microsoft and Google infrastructure for command-and-control, the group significantly increases the difficulty for defenders to distinguish between malicious exfiltration and normal business operations. The modular nature of the framework suggests a long-term, adaptable development cycle geared toward persistent espionage.
## Mitigations
* **Cloud Monitoring:** Audit Microsoft Graph API logs for unusual activity, specifically looking for the creation of calendar events with attachments and future-dated entries.
* **DNS Inspection:** Monitor for high volumes of DNS queries or unusual A-record responses that might indicate DNS tunneling or token refreshing.
* **Endpoint Detection:** Implement EDR rules to identify .NET NativeAOT-compiled binaries and unauthorized DLL loading by unusual processes.
* **Network Filtering:** Restrict access to Google Apps Script (`script.google[.]com`) unless required for business functions, and inspect traffic for patterns consistent with C2 relaying.
* **Identity Management:** Monitor for unusual OAuth token refreshes and scrutinize Entra ID (Azure AD) credential modifications.