Iranian State-Sponsored Hackers Unveil Cavern C2 Framework: Multi-Format .NET Compilation Bypasses All Security Detection Tools
In early July 2026, Israeli cybersecurity firm Check Point Research published a detailed report exposing a previously undocumented Iranian threat actor tracked as Cavern Manticore. The group, assessed to operate under Iran’s Ministry of Intelligence and Security (MOIS), has been deploying a highly modular command-and-control framework named Cavern (also referred to as Cav3rn) since the beginning of 2026.
What Happened
The campaign primarily targets Israeli IT service providers and government organizations. Unlike earlier Iranian APT groups such as MuddyWater and OilRig that frequently reuse publicly available tools, Cavern Manticore developed an entirely custom framework written in .NET yet deliberately compiled into three distinct binary formats. This design choice forces security researchers to switch between completely different analysis toolchains, significantly raising the cost and complexity of investigation. The framework has maintained near-zero or extremely low detection rates on VirusTotal, rendering most commercial security products ineffective.
Technical Analysis: Weaponizing Compilation Formats
Cavern’s primary innovation lies not in conventional obfuscation techniques such as packing or control-flow flattening, but in its use of incompatible compilation formats as an anti-analysis layer. The framework consists of three categories of modules:
- .NET Framework (pure IL): Post-exploitation modules including mhm.dll for file operations and DPAPI decryption, db.dll for SQL database manipulation, and ode.dll for Active Directory reconnaissance. Each module executes inside its own isolated AppDomain and is unloaded immediately after use, leaving no artifacts on disk.
- Mixed-mode C++/CLI (IL + native code): The core Agent, disguised as uxtheme.dll (Windows theme library), contains 83 exported functions of which 82 are empty decoys designed to trap sandboxes; only one performs actual malicious activity.
- .NET 8 Native AOT (pure native): Communication module n-HTCommp.dll, network reconnaissance module n-ten.dll, and SOCKS5 proxy module n-sws.dll. The entire .NET runtime is statically linked, and strings only materialize at runtime. Check Point researchers had to develop a custom IDA Pro plugin to recover metadata from these binaries.
Because each module requires a different analysis workflow, experience gained from examining one component cannot be reused on the others, forcing defenders to maintain three separate reverse-engineering capabilities.
Attack Chain: Abusing Trusted RMM Infrastructure
Initial access is obtained by compromising an organization’s remote monitoring and management (RMM) platform rather than exploiting zero-day vulnerabilities. Attackers abuse the legitimate update functionality of SysAid software to push malicious code. A WinDirStat DLL side-loading chain is placed in C:\ProgramData\WinDir\, where the legitimate WinDirStat.exe loads the tampered uxtheme.dll (Cavern Agent). The Agent then beacons to the C2 server hospitalinstallation[.]com over HTTPS or WebSocket, retrieving additional modules on demand.
Network traffic is encrypted with XOR key 0x48, Base64-encoded, and uses a fixed Edge browser User-Agent string along with a custom X-User-token header. Protocol fields are delimited by “_;;_” and parameters by “_,_”. The Agent supports hot updates—it can rename its own DLL, write a new version, and load it without requiring a system reboot—followed by aggressive cleanup that removes all files except the communication module, configuration, and logs. Error messages left in the code, such as “What is this sh*t?! where is get_version?!?!”, suggest manual development by a specific individual rather than automated generation.
Impact: Systematic Weaponization of Supply-Chain Trust
The operation demonstrates three layers of trust abuse: first, compromising IT service providers to reach downstream customers; second, leveraging legitimate software update mechanisms as distribution vectors; and third, coordinated activity between Cavern Manticore and MuddyWater against aviation, energy, and government targets in Egypt, Israel, and the UAE. These parallel campaigns indicate Iran is escalating its cyber operations in response to regional geopolitical tensions.
Defense Recommendations
Organizations should enforce least-privilege access for MSPs, implement change-approval workflows for RMM updates, and monitor for the following indicators of compromise: C2 domain hospitalinstallation[.]com (and historical domains adserviceupdate[.]com, hygienehistory[.]com), file path C:\ProgramData\WinDir\WinDirStat.exe, mutexes MYMUTEX123HELLP02 and MYMUTEX123HELLP04, and network artifacts including the fixed Edge User-Agent and XOR key 0x48. Enabling Windows Code Integrity policies and closely auditing non-privileged directories are also advised.
Conclusion
Cavern Manticore represents a strategic shift from tool-versus-tool competition to analysis-cost competition. By designing a framework whose goal is not merely to evade detection but to make meaningful analysis prohibitively expensive, the group challenges traditional security operations models that rely on manual reverse engineering. The incident underscores that supply-chain security requires continuous verification of every trust relationship, from MSP access rights to automated update mechanisms.
Related articles
US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab
The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.
APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations
The Russian-linked APT28 group, also known as BlueDelta, has deployed a new lightweight backdoor called HOOKEDGE as part of a cyber-espionage campaign against strategic European entities. The attacks, assessed with moderate confidence, targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Turkey between September 2025 and April 2026. Infection begins with spear-phishing emails delivering Microsoft Word documents containing malicious macros that mimic official Spanish government materials. Upon execution, the macros drop files, establish persistence via scheduled tasks, and deploy the HOOKEDGE backdoor written in batch scripts. The malware uses hidden Microsoft Edge instances and the legitimate webhook.site service to blend command-and-control traffic with normal web activity. In high-value victims, operators installed a second HOOKEDGE instance with five-minute check-ins for faster control and data collection. The backdoor shows strong code similarities to the older HEADLACE implant previously attributed to the same group.
Iran-Linked Cyber Attack Leaves Small UK Power Plant Offline for Four Days
A cyber attack attributed to hackers with suspected ties to Iran took a small-scale UK power generation facility offline for approximately four days in July 2026. The incident affected a roughly 15 MW generator used to support peak demand periods, yet caused no customer outages or disruption to the national electricity grid. British authorities have not issued an official attribution, and investigators have not publicly identified the malware, vulnerability, or initial access vector used in the operation. Recovery required four days of extensive validation across controllers, configurations, security systems, and remote access points to ensure no residual risks remained. The case highlights the operational challenges of restoring industrial control environments after suspected nation-state activity. In response, UK authorities have strengthened guidance for the energy sector and are considering additional protective measures for critical infrastructure suppliers.
Iran-Linked Tortoiseshell Group Deploys Malicious wtsapi32.dll Backdoor for Persistent Windows Access
Researchers have uncovered new tools deployed by the Tortoiseshell group, an Iranian-linked threat actor also tracked as Mirage Kitten, UNC1549, and Nimbus Manticore. The campaign features a Windows backdoor disguised as the legitimate wtsapi32.dll library that silently establishes reverse SSH tunnels over port 443 to maintain access to compromised networks. Active since at least 2018, the group has targeted defense, aerospace, technology, IT services, and military organizations primarily in the Middle East and the United States. The malware preserves expected Windows API functions while enabling command execution, file exfiltration, in-memory DLL loading, directory listing, and system reconnaissance. Associated infrastructure spans the United Arab Emirates, Saudi Arabia, the United Kingdom, Belgium, Canada, Australia, and Japan.