Iran-Linked Cavern Manticore Uses Modular C&C Framework in Attacks on Israel
Summary
Check Point reports that Cavern Manticore, an Iran-linked APT, used a modular .NET C&C framework in attacks targeting Israeli organizations, with SysAid update-feature abuse leading to WinDirStat DLL sideloading.
Key points
- Check Point tracks the actor as Cavern Manticore and says it focuses on government entities and IT providers; links to Iran’s MOIS are suspected, with possible ties to Lyceum.
- The reported infection chain abuses SysAid’s software update feature to sideload a WinDirStat DLL, which leads to execution of the Cavern agent.
- The agent retrieves operator-selected modules for file operations, database enumeration and manipulation, brute-force activity, reconnaissance, and tunneling.
- The framework uses different compilation formats as an anti-analysis layer; modules run in separate AppDomains that are terminated when unloaded.
- The agent deletes most files and subdirectories in its working directory, retaining the communication module, configuration, and logs.
- In observed intrusions, the actor used RMM tools and browser-based remote desktop for lateral movement and remote printing for data exfiltration.
- Check Point reports cases in which the actor moved through multiple IT providers before reaching an intended target.
Article Details
- Attack Vectors
- The infection chain abuses SysAid’s software update feature to sideload a WinDirStat DLL, leading to execution of the Cavern agent.
- After establishing command-and-control communication, the agent retrieves additional modules in response to operator commands.
- Modules support LDAP and SMB brute-force activity, file operations, database enumeration and manipulation, and network reconnaissance.
- The actor used remote monitoring and management solutions for lateral movement between victims.
- Browser-based remote desktop technologies were used to access victims’ environments.
- Remote printing features were used for data exfiltration.
- The framework supports SOCKS5 proxying and WebSocket/WSS tunneling.
MITRE ATT&CK
T1105 · Ingress Tool TransferThe Cavern agent fetches additional modules after receiving commands from the operator.T1110.001 · Password GuessingDedicated modules perform LDAP brute-force activity.T1219 · Remote Access ToolsThe actor used remote monitoring and management solutions for lateral movement between victims.T1574.002 · DLL Side-LoadingThe infection chain sideloads a WinDirStat DLL after abusing SysAid’s software update feature.
Threat Actors
Products
SysAidThe infection chain begins with the abuse of SysAid’s software update feature to sideload a WinDirStat DLL, which leads to the execution of the Cavern agent.WinDirStatThe infection chain begins with the abuse of SysAid’s software update feature to sideload a WinDirStat DLL, which leads to the execution of the Cavern agent.
Countries
IranAn Iran-linked advanced persistent threat (APT) actor has been using a modular command-and-control (C&C) framework in recent attacks targeting organizations in Israel, Check Point reports.IsraelAn Iran-linked advanced persistent threat (APT) actor has been using a modular command-and-control (C&C) framework in recent attacks targeting organizations in Israel, Check Point reports.