Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

Summary: Check Point Research attributes a campaign using a previously undocumented modular C2 framework called Cavern to an Iranian MOIS-affiliated cluster it tracks as Cavern Manticore, which targets Israeli IT providers and government sectors and shares tactical overlaps with MuddyWater and Lyceum. The chain begins with SysAid's software update feature to trigger DLL side-loading of a trojanized uxtheme.dll carrying the Cavern Agent, which loads n-HTCommp.dll to contact hospitalinstallation[.]com and pull post-exploitation modules over HTTPS or WebSocket, with components split across .NET Framework, Mixed-Mode C++/CLI, and Native AOT compilation.
What you should know: The actor moved from an initial compromised IT provider to a second-hop provider before reaching the intended target, weaponizing trusted service-provider relationships and RMM deployments - so the vendor with remote access to your estate is the intrusion path, not a bystander.

Read the original at The Hacker News ↗