Cavern Manticore

Summary

Iran-nexus espionage cluster that Check Point Research has tracked since early 2026 against Israeli government organisations and IT providers. It moves through Israel's IT supply chain — from a compromised IT provider to a second-hop provider and on to the intended target — and abuses remote monitoring and management (RMM) software already present in victim environments, in one case using a legitimate SysAid software-deployment feature (no SysAid vulnerability was involved) to push malware to another machine. Its custom modular C2 framework (Check Point's 'Cavern agent' and 'Cavern modules') is built on .NET but compiled to Mixed-Mode C++/CLI and Native AOT to frustrate analysis, isolates each module in its own AppDomain, and proxies C2 through victim-side IIS servers. Check Point links it to MOIS through tradecraft overlaps with Lyceum and MuddyWater and an Iranian hosting provider; SentinelLabs notes the reporting is single-vendor and treats the mapping as moderate confidence.

Attribution

Single-vendor reporting; corroboration limited

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Check Point Research (Research, 2026-07-06)
  Technical overlaps with MOIS-linked actors, incl. MuddyWater and Lyceum
• SentinelLabs (Research, 2026-07-21)
  Public corroboration limited; moderate confidence

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 2

Infrastructure patterns

• Older module talks to a cac.aspx handler on a separate IIS server at its domains (Check Point, 2026)

Reporting and advisories 1

• Check Point Research
  Cavern Manticore: Exposing Iran-Linked Modular C2 Framework