Cavern Manticore Uses New Cavern C2 Framework Against Israeli Organizations
Summary
Check Point Research attributes attacks on Israeli IT providers and government entities to Cavern Manticore, documenting trojanized SysAid updates, DLL side-loading and Cavern C2 modules for reconnaissance, lateral movement, tunneling and data theft.
Key points
- Check Point Research describes Cavern (Cav3rn) as a previously undocumented modular C2 framework and attributes its use to Cavern Manticore, a cluster with reported tactical overlaps with MuddyWater and Lyceum.
- The documented attack chain abuses SysAid’s software update feature to start DLL side-loading and execute a trojanized uxtheme.dll containing the Cavern Agent.
- The agent uses n-HTCommp.dll to contact hospitalinstallation[.]com and fetch additional modules over HTTPS or WebSocket.
- Five identified modules support file operations and transfers, SQL database access, Active Directory reconnaissance, network scanning and tunneling.
- The components use .NET Framework, Mixed-Mode C++/CLI and Native AOT; the article describes these formats and per-module AppDomain isolation as anti-analysis or anti-forensics measures.
- Check Point reports that operators moved through IT service providers toward intended targets, and in some cases used browser-based remote desktop features, including remote printing, to exfiltrate data when other transfer options were restricted.
Article Details
- Attack Vectors
- Attackers abused SysAid's software update feature to initiate a DLL side-loading chain that executed a trojanized uxtheme.dll containing the Cavern Agent.
- The agent used n-HTCommp.dll to contact the reported C2 server and retrieve additional post-exploitation modules over HTTPS or WebSocket.
- Reported modules support Active Directory reconnaissance, LDAP brute-force attempts, network and port scanning, share enumeration, and SMB brute-force attempts.
- The activity involved movement from a compromised IT provider through a second-hop provider to an intended target, leveraging trusted service-provider relationships.
- The report says browser-based remote desktop technologies were used to access targets, and remote printing was sometimes abused to exfiltrate data when clipboard or file-transfer features were restricted.
- Defensive Notes
- The report highlights trusted service-provider relationships and deployments of Remote Monitoring and Management solutions as risks in this activity; it provides no specific mitigation steps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hospitalinstallation[.]com | Reported C2 server contacted by the Cavern Agent. |
MITRE ATT&CK
T1046 · Network Service DiscoveryThe n-ten.dll module supports network reconnaissance and port scanning.T1071.001 · Web ProtocolsThe agent contacted its C2 server and retrieved modules over HTTPS or WebSocket.T1083 · File and Directory DiscoveryThe mhm.dll module supports file enumeration and recursive file searches.T1087.002 · Domain AccountThe ode.dll module supports Active Directory user and group enumeration.T1105 · Ingress Tool TransferThe agent fetched additional post-exploitation modules from the C2 server.T1110.001 · Password GuessingThe reported modules attempt LDAP and SMB brute force.T1199 · Trusted RelationshipThe activity moved from a compromised IT provider through a second-hop provider to an intended target, leveraging trusted provider relationships.T1574.001 · DLLThe attack chain used DLL side-loading to execute a trojanized uxtheme.dll containing the Cavern Agent.
Threat Actors
Cavern ManticoreCheck Point Research attributed the campaign using the Cavern C2 framework to this tracked cluster; the article reports tactical overlaps with MuddyWater and Lyceum.MuddyWaterSeparately from the Cavern Manticore attribution, the article says this Iranian state-sponsored threat actor was observed conducting broad reconnaissance and later targeted credential-harvesting and data-exfiltration activity.
Products
Tools
Countries
Egyptand government sectors in the Middle East, including aviation, energy, and public sector entities in Egypt, Israel, and the United Arab Emirates.IranAn Iranian hacking group affiliated with Iran’s Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targetingIsraelThe development unfolds against the backdrop of the ongoing joint military operation launched by Israel and the U.S.United Arab Emiratesthe Middle East, including aviation, energy, and public sector entities in Egypt, Israel, and the United Arab Emirates.
Industries
Aviationfrom broad reconnaissance to targeted credential harvesting and data exfiltration attacks against aviation, energy, and government sectors in the Middle East, including aviation, energy, and public sectorEnergybroad reconnaissance to targeted credential harvesting and data exfiltration attacks against aviation, energy, and government sectors in the Middle East, including aviation, energy, and public sector entities inGovernmentAn Iranian hacking group linked to MOIS has been using the modular Cavern (Cav3rn) C2 framework to target Israeli organizations, especially IT providers and government sectors.