Full Report
Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting Israeli organizations, with a focus on IT providers, and government sectors. Cavern Manticore is an Iran MOIS (Ministry of Intelligence and Security)-linked actor, with links to the OilRig […] The post Cavern Manticore: Exposing Iran-Linked Modular C2 Framework appeared first on Check Point Research.
Analysis Summary
# Threat Actor: Cavern Manticore
## Attribution & Identity
* **Actor Name:** Cavern Manticore
* **Attribution:** Iran-nexus APT group linked to the **Ministry of Intelligence and Security (MOIS)**.
* **Associated Groups/Aliases:**
* Linked to the **OilRig** subgroup known as **Lyceum**.
* Shares technical overlaps with **MuddyWater**.
## Activity Summary
Since early 2026, Check Point Research (CPR) has tracked this group’s deployment of a new modular command-and-control (C2) framework. The group has been observed gaining initial footholds by abusing legitimate Remote Monitoring and Management (RMM) software and deploying a sophisticated, multi-format .NET-based framework to maintain persistence and conduct post-exploitation activities.
## Tactics, Techniques & Procedures
* **Anti-Analysis & Evasion:**
* **Multi-format Compilation:** Uses .NET Framework (IL-only), Mixed-Mode C++/CLI (IL + Native), and .NET 8 Native AOT to complicate reverse engineering.
* **Low Detection:** Most samples show zero or very low detection rates on VirusTotal.
* **Steganography:** Uses JPEG-magic prefixed PNG files (`.CvnC.png`, `.CvnA.png`, `.CvnR.png`) for command and result obfuscation.
* **Anti-Forensics:** Utilizes per-module **AppDomain isolation** to prevent cross-module forensic reconstruction.
* **Initial Access:** Abuse of existing legitimate **RMM tools** (e.g., SysAid software-deployment features) within the victim's environment.
* **Lateral Movement & Reconnaissance:**
* LDAP querying for active directory discovery.
* Network tunneling and database browsing.
## Targeting
* **Sectors:** Government sectors, IT providers, and critical infrastructure.
* **Geography:** Primarily **Israel**.
* **Victims:** Specific Israeli organizations and IT service providers.
## Tools & Infrastructure
* **Malware Framework:** **Cavern Framework** (consisting of *Cavern agents* and *Cavern modules*).
* **Malware Families:**
* `Cav3rn`: HTTP module/agent.
* `mhm.dll`: Specialized variant of the agent.
* **Infrastructure:**
* **C2 Domains:** `hygienehistory[.]com`
* **C2 Endpoints:** `https://hygienehistory[.]com/cac.aspx`
* **Host Artifacts:**
* **Mutexes:** `MYMUTEX123HELLP`, `MYMUTEX123HELLP02`, `MYMUTEX123HELLP04`
* **Files:** `config.txt`, `Cvn.cfg.A`, `Cvn.cfg.U`
* **PDB Path:** `C:\Users\rick\Desktop\Modules\cavern\`
## Implications
Cavern Manticore demonstrates a high level of operational maturity by utilizing "Native AOT" and "Mixed-Mode" compilation, which bypasses traditional .NET decompilers. Their focus on IT providers suggests a "supply chain" or "hub-and-spoke" targeting strategy, where compromising one provider grants access to multiple high-value Israeli government downstream targets. The use of legitimate RMM tools indicates they are adept at "living off the land" to avoid early-stage detection.
## Mitigations
* **RMM Monitoring:** Implement strict logging and alerting for legitimate RMM tools (like SysAid) used for unexpected software deployments or lateral movement.
* **Behavioral Detection:** Focus on detecting .NET Native AOT binaries that lack standard metadata or exhibit unusual network behavior, as signature-based detection is currently ineffective.
* **Active Directory Protection:** Monitor for unauthorized LDAP queries and large-scale network scanning originating from internal workstations.
* **Network Segmentation:** Restrict the communication of IT management servers and ensure that C2-related domains (e.g., `hygienehistory[.]com`) are blocked at the perimeter.