Check Point Details Cavern Manticore’s Modular C2 Framework and Intrusions
Summary
Check Point analyzes Cavern, a modular .NET C2 framework used by Iran-linked Cavern Manticore against Israeli organizations. The malware supports reconnaissance, data access, credential attacks and tunneling; intrusions abused RMM tools and trusted IT-provider access.
Key points
- Check Point tracks Cavern Manticore as an Iran-nexus actor targeting Israeli government and IT organizations, with technical overlaps to MOIS-linked groups including MuddyWater and Lyceum.
- Observed intrusions used existing RMM software to deploy a DLL-sideloading package; SysAid itself was not compromised, and no SysAid vulnerability was involved.
- The Cavern framework separates its core agent and communications from post-exploitation modules, compiled across .NET Framework, Mixed-Mode C++/CLI and NativeAOT formats.
- Its modules support file and database access, DPAPI decryption, Active Directory and network reconnaissance, credential brute-forcing, and SOCKS5/WebSocket tunneling.
- The framework uses per-module AppDomain isolation, cleanup, and varied compilation formats to hinder analysis; most observed samples had zero or very low VirusTotal detection rates.
- The article describes supply-chain movement from compromised IT providers to second-hop providers and intended targets, including abuse of browser-based remote desktop tools.
- Check Point recommends reviewing logs, process execution and file activity involving uxtheme.dll, especially unusual DLLs and execution in C:\ProgramData.
Article Details
- Attack Vectors
- CPR observed initial footholds through abuse of existing RMM software in multiple intrusions.
- The actor moved through compromised IT providers and second-hop providers to reach intended targets by abusing trusted administrative access relationships.
- After gaining access, the actor abused SysAid's legitimate software-deployment feature to deliver a WinDirStat DLL-sideloading package. The article explicitly states that SysAid was not compromised and no SysAid vulnerability was involved.
- WinDirStat.exe loaded a trojanized uxtheme.dll containing the Cavern Agent, which loaded its communication module and retrieved additional modules on operator command.
- Post-exploitation modules support user-secret decryption, database access, LDAP credential testing, SMB credential spraying, network reconnaissance, and SOCKS5/WebSocket tunneling.
- The actor reportedly used browser-based remote desktop access and, in some cases, remote printing to exfiltrate data when clipboard and file-transfer capabilities were restricted.
- Defensive Notes
- Monitor anomalous activity originating from legitimate RMM software, enforce strict access controls, limit remote sessions, and reduce exposure through third-party management infrastructure.
- Review logs, process execution events, and file activity involving uxtheme.dll for DLL-sideloading activity.
- Examine C:\ProgramData for unusual DLL placement, recently created folders, unsigned binaries, and suspicious execution patterns.
- Supplement static indicators with detection of malware behavior, C2 infrastructure, and abuse of trusted administrative channels.
- CPR identifies the fixed Microsoft Edge User-Agent and custom X-User-token header as useful transport artifacts; the token contains the agent ID followed by 00.
- Mixed-Mode agents require both managed and native analysis. NativeAOT modules require runtime metadata and string reconstruction; ordinary string scans and import-based triage can miss their capabilities.
- Per-module AppDomain unloading and startup directory cleanup can remove recoverable module artifacts.
- Check Point states that Threat Emulation and Harmony Endpoint provide coverage against the reported threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | adserviceupdate[.]com | Domain hosting an attacker-controlled or attacker-deployed C2 handler invoked by the older Cav3rn HTTP module. |
| DOMAIN | auth[.]hospitalinstallation[.]com | C2 domain used by older Cavern Agent builds. |
| DOMAIN | google[.]com[.]hospitalinstallation[.]com | C2 domain used by newer agents; its prefix visually imitates google.com in proxy logs. |
| DOMAIN | hospitalinstallation[.]com | Parent domain of the reported Cavern C2 infrastructure. |
| DOMAIN | hygienehistory[.]com | Domain hosting an attacker-controlled or attacker-deployed C2 handler invoked by the older Cav3rn HTTP module. |
| SHA256 | 0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8 | Older mhm.dll file manager variant retaining Cav3rn naming artifacts. |
| SHA256 | 2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0 | Cavern network reconnaissance module n-ten.dll. |
| SHA256 | 30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10 | Cavern LDAP and Active Directory module ode.dll. |
| SHA256 | 37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066 | Cavern Agent uxtheme.dll, build 02. |
| SHA256 | 5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42 | Cavern SQL database browser module db.dll. |
| SHA256 | 541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819cb | Older non-modular Cav3rn agent; not part of the documented modular intrusion. |
| SHA256 | 5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18 | Oldest recovered Cavern Agent uxtheme.dll build. |
| SHA256 | 7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a | Cavern SOCKS5 and WebSocket tunnel module n-sws.dll. |
| SHA256 | 8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134 | Cavern file manager module mhm.dll. |
| SHA256 | 92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b | Cavern Agent uxtheme.dll, build 04. |
| SHA256 | a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41 | Cavern communication module n-HTCommp.dll. |
| SHA256 | b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86 | Cavern communication module n-HTCommp.dll. |
| SHA256 | cbc9485db715e1b8cc384fe94b4cceadca4006cda8a5e28adc8848529cfafc93 | Older non-modular Cav3rn agent; not part of the documented modular intrusion. |
| SHA256 | ccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e34748 | Older Cav3rn HTTP companion module CAV3RN_Http_Module. |
| URL | hxxps[:]//adserviceupdate[.]com/cac[.]aspx | Operator-deployed ASP.NET C2 handler invoked by the older Cav3rn HTTP module; underlying server ownership is undetermined. |
| URL | hxxps[:]//hygienehistory[.]com/cac[.]aspx | Operator-deployed ASP.NET C2 handler invoked by the older Cav3rn HTTP module; underlying server ownership is undetermined. |
MITRE ATT&CK
T1005 · Data from Local SystemThe file manager supported reading and transferring local files, and the communication module could upload a local file to an operator-supplied URL.T1016 · System Network Configuration DiscoveryThe network module exposed network-interface, IP-configuration, and ARP-table queries.T1018 · Remote System DiscoveryThe network module enumerated domain computers through NetServerEnum and supported host pinging.T1027 · Obfuscated Files or InformationCPR assessed the deliberate mixture of Mixed-Mode C++/CLI and NativeAOT compilation as an anti-analysis layer requiring different reconstruction workflows.T1027.003 · SteganographyOlder Cav3rn agents read steganographic command images from inpt and wrote result images to outpt.T1027.007 · Dynamic API ResolutionNativeAOT modules resolved security-sensitive Windows APIs through runtime P/Invoke descriptor tables rather than exposing them in PE imports.T1036.005 · Match Legitimate Resource Name or LocationThe malicious uxtheme.dll mimicked the Windows theming library with 83 exports, 82 of which were inert stubs.T1046 · Network Service DiscoveryThe n-ten.dll module implemented TCP port scanning.T1049 · System Network Connections DiscoveryThe network module implemented netstat-style connection enumeration.T1069.001 · Local GroupsThe network module enumerated local groups and their members using NetLocalGroup APIs.T1069.002 · Domain GroupsThe LDAP module enumerated Active Directory groups and group membership.T1070.004 · File DeletionNewer agents deleted working-directory files and subdirectories at startup, preserving only the communication module, configuration, and logs.T1071.001 · Web ProtocolsCavern used HTTPS polling and WebSocket/WSS communication; HTTP beacons queried /profile and submitted results to /gallery.T1072 · Software Deployment ToolsAfter gaining access, the actor abused SysAid's legitimate software-deployment feature to deploy malware to another machine.T1082 · System Information DiscoveryThe mhm.dll module implemented host-information collection.T1083 · File and Directory DiscoveryThe file manager enumerated drives, files, and directories and performed recursive file searches with content matching.T1087.001 · Local AccountThe network module used NetUserEnum and NetUserGetInfo to enumerate users and retrieve user information.T1087.002 · Domain AccountThe LDAP module enumerated Active Directory users and queried user properties.T1090 · ProxyThe n-sws.dll module implemented a SOCKS5 proxy that relayed traffic through authenticated WebSocket/WSS tunnels.T1105 · Ingress Tool TransferThe agent retrieved post-exploitation modules from C2 and accepted Base64/GZip module updates that it wrote as numbered DLLs.T1110.001 · Password GuessingLdapBrute tested supplied username and password lists with configurable delays and break-on-success behavior.T1110.003 · Password SprayingCPR described NetUseBrute as an SMB credential-spraying primitive that tested supplied credential pairs against a target share.T1132.001 · Standard EncodingModern HTTP C2 bodies used Base64, while the older Cav3rn HTTP module encoded telemetry using Base32.T1132.002 · Non-Standard EncodingModern Cavern C2 traffic used an XOR transform with key 0x48 across HTTP and WebSocket channels.T1135 · Network Share DiscoveryThe network module enumerated mapped drives, network resources, and shares, including through NetShareEnum.T1199 · Trusted RelationshipThe actor moved from compromised IT providers through second-hop providers to intended targets using trusted service-provider access.T1213 · Data from Information RepositoriesThe database module supported SQL database enumeration, queries, and exports using operator-supplied credentials.T1219 · Remote Access ToolsCavern Manticore abused existing RMM software for access and used browser-based remote desktop technologies to access targets.T1555 · Credentials from Password StoresThe file manager used ProtectedData.Unprotect under the compromised user's token to decrypt operator-supplied DPAPI-protected secrets.T1560.002 · Archive via LibraryThe file manager implemented ZIP archive creation and GZip/Base64 file-transfer operations.T1574.002 · DLL Side-LoadingThe legitimate WinDirStat.exe loaded the trojanized uxtheme.dll containing the Cavern Agent.T1620 · Reflective Code LoadingManaged modules were loaded through reflection inside dedicated AppDomains and invoked through the DotNetProxy mechanism.
People
Threat Actors
Cavern ManticoreCPR tracks this Iran-nexus actor targeting Israeli government and IT organizations and attributes use of the Cavern framework to it; the report assesses links to MOIS-aligned activity.LyceumDescribed as an OilRig subgroup with links and technical overlaps to Cavern Manticore, including comparable C2 proxying and encoding patterns.MuddyWaterNamed as an Iranian MOIS-linked actor with technical overlaps; the report references its past targeting of SysAid servers as attribution context, not proof that it conducted these intrusions.OilRigNamed as the parent grouping of Lyceum in the report's discussion of technical overlaps and possible Iranian attribution.
Malware
Cav3rnPROC_KILL = 501, // 0x1F5 - kill process (not in modular set; older Cav3rn)CAV3RN_Http_Moduleoutpt\, while the HTTP exchange against the C2 is performed by a separate HTTP companion module (CAV3RN_Http_Module), which we later recovered as a third Cav3rn-era sample.CavernCavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCavern AgentThese components are used as Cavern agent and Cavern modules.
Vendors
Check PointCheck Point Research (CPR) tracks ‘Cavern Manticore’ as an Iran-nexus threat actor operating against Israeli targets, with a focus on the government and IT sectors.Fars DataFinally, WHOIS analysis of the root domain observed in the campaign, hospitalinstallation[.]com, showed that it was registered through Fars Data, an Iranian hosting provider.
Products
Active Directory5.3 LDAP / Active Directory Module – “ode.dll”Check Point Threat EmulationCheck Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of this attack and protect against threats described in this report.Harmony EndpointCheck Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of this attack and protect against threats described in this report.IISrather than an abused legitimate page: the request and response shape is a custom protocol no clean IIS server would understand or produce, and the companion’s ServerCertificateValidationCallback is hard-codedSQL ServerThe database module implements a REST-like route dispatcher that accepts JSON commands with operator-supplied SQL Server credentials passed through pseudo-HTTP headers.SysAidNote: SysAid was not compromised, and no SysAid vulnerability was involved.WinDirStatThe recovered execution chain begins with SysAid’s software update feature, which the actor leverages to deploy a WinDirStat DLL sideloading package to C:\ProgramData\WinDir\WinDirStat.exe.
Tools
dnSpyExThese modules are trivially decompilable with tools such as ILSpy or dnSpyEx.GhidraTo pull useful metadata back out of the NativeAOT samples, we ported Washi’s Ghidra NativeAOT plugin (ghidra-nativeaot; write-up: Recovering Metadata from .NET Native AOT Binaries) to IDA Pro.ghidra-nativeaotTo pull useful metadata back out of the NativeAOT samples, we ported Washi’s Ghidra NativeAOT plugin (ghidra-nativeaot; write-up: Recovering Metadata from .NET Native AOT Binaries) to IDA Pro.IDA ProTo pull useful metadata back out of the NativeAOT samples, we ported Washi’s Ghidra NativeAOT plugin (ghidra-nativeaot; write-up: Recovering Metadata from .NET Native AOT Binaries) to IDA Pro.ida-nativeaotIt is available at ida-nativeaot.ILSpyThese modules are trivially decompilable with tools such as ILSpy or dnSpyEx.
Countries
Industries
DefenseThe adversary’s ability to gain access to organizations in the defense and government sectors during the U.S.GovernmentCheck Point Research (CPR) tracks ‘Cavern Manticore’ as an Iran-nexus threat actor operating against Israeli targets, with a focus on the government and IT sectors.ITThe attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it.