Geopolitical Context & the Rise of Cavern Manticore
The theater of cyber warfare in the Middle East has experienced a definitive shift toward highly obfuscated, modular espionage operations. Recent findings by Check Point Research have exposed a sophisticated cyber espionage campaign orchestrated by an Iranian state-sponsored group, operating under the purview of Iran's Ministry of Intelligence and Security (MOIS). Check Point tracks this specific threat cluster as Cavern Manticore. This actor has deployed a previously undocumented, highly adaptable command-and-control (C2) framework known as Cavern, or Cav3rn.
Cavern Manticore does not operate in isolation. Threat intelligence analysis reveals that the cluster shares significant tactical overlaps with known Iranian state-sponsored entities, specifically MuddyWater and Lyceum. Lyceum itself is widely assessed by the intelligence community to function as a subgroup within the broader Iranian state-sponsored apparatus. By mapping the behavioral signatures of Cavern Manticore, security researchers observe a maturation in MOIS-affiliated capabilities. The transition from noisy, highly visible disruption operations toward stealth-oriented, persistent espionage indicates a strategic recalibration in Tehran's cyber objectives.
The deployment of the Cavern framework represents a calculated investment in operational security. Building custom C2 infrastructure requires immense resources, signaling that the MOIS considers the targeted data high-priority. Rather than relying on commercial off-the-shelf red-teaming tools that modern endpoint detection and response (EDR) platforms instantly flag, Cavern Manticore has engineered a proprietary ecosystem designed specifically to bypass modern heuristic and signature-based defenses.
Strategic Targeting of IT Providers and Government Sectors
The operational scope of the Cavern framework is tightly focused on high-value intelligence pipelines in Israel. Cavern Manticore has systematically singled out Israeli government sectors and domestic IT service providers. Targeting managed service providers (MSPs) and IT vendors is a proven multiplier in cyber espionage. A successful breach of a single IT provider grants the attackers privileged, administrative access to a multitude of downstream client networks, effectively turning trusted vendor relationships into unmonitored attack vectors.
This campaign underscores the vulnerabilities inherent in the software supply chain. By compromising IT providers, Cavern Manticore bypasses the heavily fortified perimeters of Israeli government networks, opting instead to infiltrate through less strictly monitored secondary channels. This "second-hop" methodology demonstrates a high degree of operational patience. The attackers establish a foothold in a lower-tier vendor network, escalate privileges, map the provider's client base, and subsequently pivot into the network of the ultimate target organization.
This systematic exploitation of trusted relationships poses a severe challenge to national security architectures. When an adversary operates entirely within the context of legitimate administrative tools and trusted third-party vendor connections, standard anomaly detection systems struggle to distinguish malicious lateral movement from routine IT maintenance.
Deconstructing the Cavern C2 Architecture
The Shared .NET Foundation and Compilation Complexity
The technical brilliance of the Cavern framework lies in its architectural design. Check Point Research describes the toolset as mature and highly adaptable, constructed entirely around a shared .NET foundation. However, the developers did not simply compile a standard .NET executable. Instead, they weaponized the compilation process itself to thwart reverse engineering.
The Cavern framework utilizes three distinct .NET compilation targets across its various
components: .NET Framework, .NET Mixed-Mode C++/CLI, and
.NET Native AOT (Ahead-of-Time). Specific payloads, such as
mhm.dll, db.dll, and ode.dll, are built as pure
.NET Framework modules. Conversely, critical components like n-HTCommp.dll,
n-ten.dll, and n-sws.dll are compiled using Native AOT.
Native AOT compilation strips away the metadata and Intermediate Language (IL) code typically present in managed .NET binaries, compiling the code directly into machine code. This eliminates the possibility of using standard .NET decompilers (like ILSpy or dnSpy) to easily read the source code. Mixed-Mode C++/CLI further complicates analysis by intertwining managed .NET code with unmanaged C++ within the same binary. This deliberate fragmentation forces malware analysts to constantly switch between disparate debugging toolsets and reconstruct metadata manually, dramatically slowing down the incident response process and delaying the development of effective defensive signatures.
The architecture maintains a strict division of responsibilities. The operation is split between the "Cavern Agent", which handles core communication, and "Cavern modules", which handle mission-specific post-exploitation tasks. This modularity allows operators to tailor their deployments based on the exact profile of the compromised machine, minimizing the forensic footprint by only loading the exact tools necessary for a specific objective.
The DLL Side-Loading Attack Chain via SysAid
To establish an initial foothold, Cavern Manticore leverages a technique known as DLL side-loading, actively abusing the software update mechanisms of legitimate applications. The documented attack chain begins with the exploitation of the software update feature within SysAid, a widely used IT service management software.
By hijacking the execution flow of the SysAid update process, the threat actors force the
legitimate application to load a malicious dynamically linked library (DLL) into its
memory space. In this campaign, the attackers utilized a trojanized DLL named
uxtheme.dll. Because the malicious code is loaded by a signed, trusted
process (the SysAid updater), many endpoint security solutions fail to block the
execution, assuming the activity is part of a routine administrative update.
Once executed, uxtheme.dll unpacks and launches the core Cavern Agent. The
agent immediately establishes persistence and prepares the environment for communication.
It loads a standalone communication module, specifically the Native AOT-compiled
n-HTCommp.dll. This specific module is tasked with reaching out to the
actor-controlled C2 server, identified as hospitalinstallation[.]com.
The communication occurs securely over HTTPS or WebSocket protocols, blending the
beaconing traffic with normal web browsing activity. From this point, the attackers can
dynamically fetch additional post-exploitation modules directly into memory based on the
specific intelligence requirements of the MOIS.
Evasion Tactics and Post-Exploitation Mechanics
Anti-Analysis Posture: Native AOT and AppDomain Isolation
Cavern Manticore's primary defense against discovery is its aggressive anti-analysis posture. As noted by Check Point Research, the varied compilation formats act as a direct anti-analysis layer. When threat hunters discover a module, the lack of standard metadata in the Native AOT files prevents immediate attribution or capability assessment. The operators have built a system that assumes compromise; they anticipate their tools will eventually be captured by Israeli cyber defense units. By making the reverse-engineering process as tedious and mathematically complex as possible, they ensure that by the time a full analysis is complete, the operational objectives of the campaign have already been met.
Beyond compilation tricks, the framework implements per-module AppDomain isolation as an active anti-forensics measure. In the .NET ecosystem, an AppDomain provides an isolation boundary for security, reliability, and versioning. Cavern Manticore abuses this feature by loading separate operational modules into isolated AppDomains within the same process. If an endpoint security scanner attempts to inspect the memory space, or if a specific module crashes, the isolated nature of the AppDomains ensures that the core agent and other active modules remain undiscovered and operational. This capability demonstrates a profound understanding of Windows memory management and forensic artifact generation.
Lateral Movement and Second-Hop Supply Chain Attacks
Once the Cavern framework secures access to an initial IT provider, the focus shifts entirely to lateral movement and reconnaissance. The operators map the internal network of the compromised vendor, searching for administrative credentials, remote monitoring and management (RMM) tools, and direct VPN connections linking the provider to its client base.
Check Point Research documented multiple instances where Cavern Manticore successfully executed "second-hop" supply chain attacks. The attackers do not stop at the first compromised IT vendor. If the initial vendor services an intermediary company that ultimately connects to the targeted Israeli government sector, the threat actors will leapfrog through the supply chain. They weaponize the inherent trust granted to these IT providers, moving laterally across organizational boundaries using the providers' own remote access infrastructure. This methodology highlights the systemic risk posed by highly interconnected software ecosystems, where the security of a government entity is entirely dependent on the security posture of its most vulnerable external vendor.
Data Exfiltration Strategies in Restricted Environments
Abusing Browser-Based Remote Desktop and Remote Printing
Securing high-value government networks often involves implementing strict data loss prevention (DLP) controls. These environments frequently restrict standard file-transfer protocols, disable USB storage access, and monitor standard command-line tools for suspicious activity. To circumvent these restrictions, Cavern Manticore has developed highly unconventional data exfiltration techniques.
Analysts observed the threat actors leveraging browser-based remote desktop technologies to interact with compromised targets. By utilizing browser-based sessions, the attackers avoid installing standalone remote access trojans (RATs) that might trigger security alerts. When operating within highly restricted environments where standard clipboard copy-paste functions and file transfers are administratively disabled, the hackers resort to abusing built-in operating system features.
Specifically, Cavern Manticore was observed utilizing remote printing features to extract sensitive information. Instead of copying a document and sending it over the network via standard protocols, the attackers send the sensitive data to a remote, attacker-controlled print spooler. This transforms the data exfiltration into standard Windows printing traffic. Because printing is a necessary business function that requires broad network permissions, network firewalls and DLP systems rarely block or inspect raw print spooler traffic. This technique showcases the operators' ability to "live off the land" (LotL), turning essential administrative features into stealthy weapons for espionage.
Connections to Broader MOIS Campaigns
The deployment of the Cavern C2 framework is part of a wider, aggressive posture adopted by MOIS-affiliated groups across the Middle East. Concurrently, the MuddyWater threat actor—which shares tactical overlaps with Cavern Manticore—has been executing massive reconnaissance campaigns. Oasis Security recently tracked MuddyWater scanning over 12,000 internet-exposed systems, actively exploiting known vulnerabilities in platforms such as SmarterMail, n8n, N‑central, Langflow, and Laravel Livewire.
These broader campaigns target aviation, energy, and government sectors across Israel, Egypt, and the United Arab Emirates. The simultaneous execution of MuddyWater's broad vulnerability exploitation and Cavern Manticore's surgical, supply-chain-focused espionage indicates a highly coordinated cyber strategy originating from Tehran. The MOIS appears to be utilizing different clusters for different phases of intelligence gathering: MuddyWater serves as the noisy, opportunistic access broker, while clusters like Cavern Manticore act as the specialized unit for high-value, deeply embedded espionage.
Conclusion
The discovery of the Cavern C2 framework represents a critical inflection point in Middle Eastern cyber geopolitics. Iranian state-sponsored actors, particularly those under the MOIS umbrella, are rapidly evolving past reliance on publicly available exploits and easily detectable malware. Cavern Manticore's use of Native AOT compilation, AppDomain isolation, and multi-hop supply chain pivoting demonstrates a tier of technical sophistication previously reserved for top-tier nation-state operators. By deliberately engineering their framework to exhaust the resources of reverse engineers, these actors are buying themselves the operational time needed to execute complex espionage within Israeli government networks.
As the interconnected nature of global IT services expands, the exploitation of trusted vendor relationships will only increase. Defending against frameworks like Cavern requires a paradigm shift: organizations can no longer trust administrative traffic simply because it originates from a signed process or a known vendor. Absolute zero-trust architecture and deep, behavioral anomaly detection are now mandatory baseline defenses against modern state-sponsored cyber warfare.
Frequently Asked Questions
uxtheme.dll containing the Cavern Agent.
If you have any doubts, Please let me know