Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

July 6, 2026 · Check Point Research · Severity: MEDIUM

Check Point Research has identified "Cavern Manticore," an Iran-linked advanced persistent threat (APT) group targeting Israeli government and IT sectors using a sophisticated modular command-and-control (C2) framework. The group, affiliated with Iran’s Ministry of Intelligence and Security (MOIS), shares ties with known Iranian threat actors like MuddyWater and Lyceum. The framework, built on .NET, employs three distinct compilation formats (.NET Framework, Mixed-Mode C++/CLI, and .NET NativeAOT) to evade analysis, forcing reverse engineers to use multiple toolsets. Post-exploitation modules enable file system access, LDAP queries, network reconnaissance, and tunneling, with low detection rates on VirusTotal. Initial access often involves abusing Remote Monitoring and Management (RMM) software in victim environments. The Cavern framework’s modular design separates core communication from mission-specific modules, allowing tailored deployments. Attackers abused SysAid’s software update feature to sideload a malicious DLL (uxtheme.dll), which acts as the Cavern Agent and loads additional modules like n-HTCommp.dll for C2 communication. Other modules include file managers, SQL browsers, and tunneling tools, all compiled differently to hinder forensic analysis. This adaptability and anti-analysis approach make Cavern Manticore a persistent threat, particularly to Israeli organizations. The group’s use of legitimate software features highlights the challenges of defending against supply-chain attacks.

Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it.

Key Points

Check Point Research (CPR) tracks ‘Cavern Manticore’ as an Iran-nexus threat actor operating against Israeli targets, with a focus on the government and IT sectors.
Cavern Manticore shares technical overlaps with other Iranian MOIS (Ministry of Intelligence and Security)-linked threat actors, including MuddyWater and Lyceum.
CPR observed a modular C2 framework in the wild, with all samples built on top of .NET but compiled into different output formats. These components are used as Cavern agent and Cavern modules.
The framework’s anti-analysis posture relies on uncommon .NET compilation formats (Mixed-Mode C++/CLI and Native AOT) that force reverse engineers into multiple toolsets and metadata-reconstruction workflows, together with per-module AppDomain isolation as an anti-forensics measure.
In malware-engine coverage, the majority of observed samples score zero or very low detection rates on VirusTotal.
Post-exploitation modules provide the threat actor with extended capabilities, including file system and database browsing, LDAP querying, network reconnaissance, and tunneling.
In multiple observed intrusions, the initial foothold was achieved through abuse of existing Remote Monitoring and Management (RMM) software deployed in the targeted organization.

Introduction

Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting Israeli organizations, with a focus on IT providers, and government sectors. Cavern Manticore is an Iran MOIS (Ministry of Intelligence and Security)-linked actor, with links to the OilRig subgroup named Lyceum. The framework reflects a mature and adaptable toolset built around a shared .NET foundation, while using multiple compilation formats across different components, including .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT. The compilation format itself becomes the anti-analysis layer that forces reverse engineers into multiple toolsets and metadata-reconstruction workflows.

During our investigation, we observed both Cavern agents and Cavern modules in the wild, highlighting a modular architecture that separates core communication capabilities from mission-specific post-exploitation functionality. This design allows the operators to tailor deployments per victim environment, limit what defenders and analysts can recover from any single victim and extend access after compromise through specialized modules for reconnaissance, data access, tunneling, and lateral movement.

Figure 1: Cavern Modules Evade Malware Engines.

Technical Analysis: Cavern – A Modular .NET C2 Framework

1. Cavern at a Glance

Cavern is a modular post-exploitation C2 framework built entirely on .NET, but deliberately compiled into three different binary formats: .NET Framework (IL-only), Mixed-Mode C++/CLI (IL + Native), and .NET 8 NativeAOT (Native-only).

The recovered execution chain begins with SysAid’s software update feature, which the actor leverages to deploy a WinDirStat DLL sideloading package to C:\ProgramData\WinDir\WinDirStat.exe. The legitimate WinDirStat.exe binary loads the trojanized uxtheme.dll, which is the Cavern Agent, and the agent in turn loads a dedicated native communication module n-HTCommp.dll to reach the C2 and then pulls down additional post-exploitation modules on operator command.

The table below provides an overview of the modules.

Component	Internal Name	Format	Role
Cavern Agent	`uxtheme.dll`	Mixed-Mode C++/CLI (.NET 4.7.2, IL + Native)	Core backdoor, module orchestrator
Communication Module	`n-HTCommp.dll`	NativeAOT (.NET 8, Native-only)	HTTPS/WebSocket transport, XOR-encrypted traffic
File Manager	`mhm.dll`	.NET Framework 4.7.2 (IL-only)	File ops, DPAPI decrypt, archive handling
SQL Browser	`db.dll`	.NET Framework 4.7.2 (IL-only)	Database enumeration, query, export, manipulation
LDAP Module	`ode.dll`	.NET Framework 4.7.2 (IL-only)	AD recon, user/group enumeration, LDAP brute-force
Network Module	`n-ten.dll`	NativeAOT (.NET 8, Native-only)	Net recon, port scan, share enum, SMB brute-force
Tunnel Module	`n-sws.dll`	NativeAOT (.NET 8, Native-only)	SOCKS5 proxy, WebSocket/WSS tunneling

2. Three Compilation Formats as Anti-Analysis

The most distinctive architectural decision in Cavern is the deliberate use of three different .NET compilation targets across its components. This is not obfuscation in the traditional sense; there is no packer, no control-flow flattening, and no string encryption anywhere in the framework. Instead, the compilation format itself becomes the anti-analysis layer, since each of the three formats has to be reversed with a different toolchain and a different workflow, and the analyst has to context-switch between them across components.

Pure .NET Framework (IL-only) modules (mhm.dll, db.dll, ode.dll) retain full symbol metadata, including the shared Command.Type enum with all 61 command IDs, readable class names like ApiEx.DatabaseBrowser, and meaningful method signatures. These modules are trivially decompilable with tools such as ILSpy or dnSpyEx. The developers chose this format for the modules that run inside the agent’s managed AppDomain, where IL code is actually required for reflection-based loading.
Mixed-Mode C++/CLI (IL + Native) agents (uxtheme.dll) combine man

Key Takeaways

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework — Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular...
Staying informed on emerging threats is key to maintaining a strong security posture.
Regular security awareness training and layered defenses remain the foundation of any effective cybersecurity program.