~/f4n6 $ grep -r "Cavern Manticore: Exposing Iran-Linked Modular C2 Framework" ./investigations/ --include="*.md"

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Jeff Davies 06 Jul 2026 6 min read

1. Executive summary

Check Point Research (CPR) has published a detailed analysis of "Cavern," a new modular .NET command-and-control (C2) framework deployed by the threat actor "Cavern Manticore" since early 2026. The actor, assessed as Iran-nexus with reported links to the OilRig subgroup Lyceum, primarily targets Israeli organizations via IT provider supply chains, abusing SysAid update features to deliver the framework. Cavern demonstrates mature, multi-format compilation (.NET Framework, Mixed-Mode C++/CLI, and .NET 8 NativeAOT) designed specifically to impede reverse engineering, coupled with modular post-exploitation capabilities including DPAPI decryption, LDAP brute-forcing, and SOCKS5 tunneling. EMEA financial services utilizing SysAid or operating complex third-party IT supplier chains face elevated risk of secondary compromise and persistent data access.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process The APT group compromises IT providers to pivot to downstream targets, constituting a major ICT-related incident requiring an established management process. Financial entities must ensure their incident response playbooks cover supply-chain compromise scenarios and C2 framework eradication.
DORA Art. 28: ICT third-party risk — general principles The threat actor leverages compromised IT providers and RMM solutions to reach final targets, directly engaging third-party risk principles. Entities must enforce strict oversight of ICT third-party providers, particularly where RMM tools and update mechanisms are involved.
NIS2 Art. 21(2)(d): supply chain security measures The initial access vector abuses the SysAid software update feature, requiring supply chain security measures to mitigate. In-scope NIS2 entities must verify the integrity of software update mechanisms and monitor for anomalous execution originating from update services.

3. Technical analysis & attack chain

Attribution caveat: "Cavern Manticore" has no MITRE ATT&CK profile in the verified reference data; attribution to this actor and its Iran-nexus/Lyceum links is unconfirmed and rests solely on Check Point Research's reporting.

The confirmed attack chain proceeds as follows:

  1. Initial Access & Delivery: The actor abuses the SysAid software update feature to deploy a WinDirStat DLL sideloading package to C:\ProgramData\WinDir\WinDirStat.exe.
  2. Execution & Defense Evasion: The legitimate WinDirStat.exe binary loads the trojanized uxtheme.dll (the Cavern Agent). The agent is a 64-bit Mixed-Mode C++/CLI DLL that exports 83 functions mimicking the legitimate Windows theming library. 82 exports are empty stubs. The single live export, EnableThemeDialogTexture (ordinal #20 / 0x14), serves as the operational entry point, creating a sandbox trap for automated analysis tools that invoke default ordinals.
  3. Persistence & Cleanup: Upon invocation, the agent creates a singleton mutex (MYMUTEX123HELLP02 or MYMUTEX123HELLP04) and initializes from config.txt. Newer builds execute aggressive directory cleanup on startup, deleting all files and subdirectories in the working directory except n-HTCommp.dll, config.txt, and log files.
  4. Command & Control: The agent loads n-HTCommp.dll, a NativeAOT .NET 8 DLL (~5.5 MB) functioning as the communication module. It uses HTTPS and WebSocket (WSS) transport. C2 traffic is XOR-encrypted with key 0x48 and Base64-encoded for HTTP paths. The C2 domains are auth.hospitalinstallation.com (older builds) and google.com.hospitalinstallation.com (newer builds). All HTTP verbs use a fixed Microsoft Edge User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0. C2-bound verbs (get, send) attach an X-User-token header containing the agent ID suffixed with 00.
  5. Module Hosting: The agent uses a dedicated AppDomain for each module execution, marshaling a proxy object (DotNetProxy) across the domain boundary to invoke the module, and then unloading the AppDomain to leave no analyzable assembly artifacts. Modules are dispatched via <Module>.run_DLL, which loads native modules (prefixed with n-) via LoadLibraryA and managed modules via reflection. All modules interface via a get_version export.
  6. Discovery & Lateral Movement: The operator pulls down specialized modules: * ode.dll (LDAP): Performs AD recon, user/group enumeration, and LDAP brute-forcing (LdapBrute). * n-ten.dll (Network): NativeAOT module providing net recon, port scanning, share enumeration, and SMB brute-forcing (NetUseBrute using WNetAddConnection2). Security-sensitive APIs are resolved via runtime P/Invoke descriptor tables to hide capabilities from import-based triage. * n-sws.dll (Tunnel): NativeAOT module implementing a SOCKS5 proxy and WebSocket/WSS tunnel.
  7. Data Access & Exfiltration: * mhm.dll (File Manager): Manages file ops, drive enumeration, GZip+Base64 file transfer, and ZIP archive handling. Crucially, it implements DPAPI decryption (CryptDecrypt using ProtectedData.Unprotect with DataProtectionScope.CurrentUser), allowing the operator to decrypt compromised user secrets. * db.dll (SQL Browser): Implements a REST-like route dispatcher for SQL database enumeration, query, export, and manipulation using operator-supplied credentials passed via pseudo-HTTP headers (x-db-user, x-db-password, x-db-host).

Older "Cav3rn" variant: The source identifies an older, non-modular version of the framework ("Cav3rn") that used steganographic command PNGs read from an inpt\ directory and an ASP.NET handler (cac.aspx) on adserviceupdate[.]com or hygienehistory[.]com for C2.

4. Mitigation & containment

P1 — Within 24 hours

  • Isolate and investigate any endpoints running SysAid or exhibiting unexpected child processes from C:\ProgramData\WinDir\WinDirStat.exe.
  • Block the following C2 domains at the network perimeter and proxy:
  • hospitalinstallation[.]com (and all subdomains)
  • adserviceupdate[.]com
  • hygienehistory[.]com
  • Deploy EDR block rules for the identified malicious DLLs (see IOC section for SHA-256 hashes). Focus on uxtheme.dll execution from C:\ProgramData\WinDir\.

P2 — Within 72 hours

  • Audit SysAid software update configurations and inspect for unauthorized update packages or modifications.
  • Implement network detection rules for the fixed Cavern User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0 combined with the X-User-token HTTP header.
  • Review Active Directory for anomalous LDAP queries or brute-force patterns originating from internal IT management systems.

P3 — Within 7 days

  • Conduct a focused review of C:\ProgramData for unusual DLL placement, recently created folders, and unsigned binaries.
  • Enforce strict application whitelisting for RMM tools and SysAid update processes to prevent DLL sideloading.
  • Verify that DPAPI-protected data (e.g., saved browser credentials) on high-value administrator accounts is inaccessible from non-interactive or unexpected service contexts.

5. Indicators of compromise

Type Value Confidence Source
sha256 37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066 High Check Point Research
sha256 92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b High Check Point Research
sha256 5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18 High Check Point Research
sha256 a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41 High Check Point Research
sha256 b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86 High Check Point Research
sha256 8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134 High Check Point Research
sha256 0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8 High Check Point Research
sha256 5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42 High Check Point Research
sha256 30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10 High Check Point Research
sha256 2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0 High Check Point Research
sha256 7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a High Check Point Research
sha256 541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819cb High Check Point Research
sha256 cbc9485db715e1b8cc384fe94b4cceadca4006cda8a5e28adc8848529cfafc93 High Check Point Research
sha256 ccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e34748 High Check Point Research
domain hospitalinstallation[.]com High Check Point Research
domain auth[.]hospitalinstallation[.]com High Check Point Research
domain google[.]com[.]hospitalinstallation[.]com High Check Point Research
domain adserviceupdate[.]com High Check Point Research
domain hygienehistory[.]com High Check Point Research 
sha256  37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066
sha256  92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b
sha256  5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18
sha256  a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41
sha256  b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86
sha256  8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134
sha256  0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8
sha256  5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42
sha256  30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10
sha256  2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0
sha256  7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a
sha256  541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819cb
sha256  cbc9485db715e1b8cc384fe94b4cceadca4006cda8a5e28adc8848529cfafc93
sha256  ccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e34748
domain  hospitalinstallation[.]com
domain  auth[.]hospitalinstallation[.]com
domain  google[.]com[.]hospitalinstallation[.]com
domain  adserviceupdate[.]com
domain  hygienehistory[.]com

6. Detection

rule Cavern_Manticore_Framework {
  meta:
    author = "Adverse Trace"
    date = "2026-07-06"
    reference = "https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/"
    description = "Detects Cavern Manticore C2 framework components based on unique strings and mutexes"
  strings:
    $mutex1 = "MYMUTEX123HELLP02" wide ascii
    $mutex2 = "MYMUTEX123HELLP04" wide ascii
    $err1 = "What is this sh*t?! where is get_version?!?" wide ascii
    $err2 = "DLL not found...Maybe you didn't upload it!!!" wide ascii
    $err3 = "tunnel message receivecd" wide ascii
    $err4 = "handeling connect ms" wide ascii
    $pdb = "C:\\Users\\rick\\Desktop\\Modules\\cavern\\" wide ascii
    $cfg = "Cvn.cfg" wide ascii
    $ext = ".CvnC.png" wide ascii
    $handler = "cac.aspx" wide ascii
    $ns = "CAV3RN_APIEX_Module" wide ascii
  condition:
    3 of them
}

title: Detect Cavern Manticore C2 Agent via Mutex Creation
id: 7a8c9d2e-1b3a-4f5c-9d8e-2a1b3c4d5e6f
status: experimental
description: Detects the creation of mutexes associated with the Cavern Manticore C2 framework agent.
references:

    - https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/
author: Adverse Trace
date: 2026/07/06
tags:

    - attack.defense_evasion
    - attack.execution
    - attack.t1574.001
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith:

            - '\WinDirStat.exe'
        StartModule|endswith:

            - '\uxtheme.dll'
    condition: selection
falsepositives:

    - Legitimate theming DLL modifications (highly unlikely in ProgramData)
level: high

Threat actor context

HEXANE · G1001 · aka Lyceum, Siamesekitten, Spirlin

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. …

No MITRE ATT&CK profile for: Cavern Manticore.

7. Sources

  • Check Point Research, "Cavern Manticore: Exposing Iran-Linked Modular C2 Framework", https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/, 2026-07-06

8. Adverse Trace position

Adverse Trace assesses the severity of this activity as High for EMEA financial services, particularly those with exposed IT supply chains or operations in the Middle East. The Cavern framework's deliberate use of multi-format .NET compilation to defeat static analysis, combined with its modular post-exploitation capabilities (DPAPI decryption, LDAP/SMB brute-forcing, SOCKS5 tunneling), represents a significant persistent threat. Attribution to "Cavern Manticore" and its Iran-nexus is unconfirmed in our verified reference data and relies solely on single-source vendor reporting; we will continue to monitor for corroborating intelligence. Clients should immediately implement the network blocks and YARA/Sigma detections provided and audit third-party IT provider access paths.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies