A New Threat Actor Emerges
Since early 2026, a previously unknown cyber group has been systematically targeting Israeli government agencies and IT firms. The group, which Check Point researchers track as Cavern Manticore, appears to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).
The findings come from a threat intelligence report published July 6. Check Point says the group shares technical fingerprints with two established Iranian-aligned adversaries: MuddyWater and Lyceum.
“The adversary’s ability to gain access to organizations in the defense and government sectors during the US military campaign ‘Operation Epic Fury’ demonstrates both a high operational tempo and a disciplined approach to target selection,” the researchers wrote.
How Cavern Manticore Breaches Networks
The group’s preferred entry point is surprisingly mundane: legitimate remote monitoring and management (RMM) software. By abusing these tools, Cavern Manticore moves laterally across a victim’s environment, then delivers malware disguised as routine software updates.
Another vector? Browser-based remote desktop tools. When clipboard copy-paste or file uploads are blocked, the attackers use remote printing features to siphon data out.
Once inside, the group weaponizes a SysAid software update mechanism to drop malicious payloads onto the target network.
The Modular C2 Framework at the Core
Cavern Manticore’s most distinctive asset is its custom modular command-and-control (C2) framework. Check Point describes it as “a mature and adaptable toolset built around a shared .NET foundation.”
The framework splits into two main components:
- Cavern agent — a persistent backdoor that handles all communication with attacker-controlled servers. It comes in multiple .NET compilation formats (.NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT) to evade detection and complicate reverse engineering.
- Cavern modules — specialized post-exploitation tools for reconnaissance, data theft, tunneling, and lateral movement. Each module is compiled separately, allowing the attackers to tailor the toolset per victim.
The framework also uses per-module AppDomain isolation. That means even if defenders discover one component on a compromised host, they cannot easily recover the full toolkit. The design keeps the group’s footprint small and its persistence high.
Check Point noted that most Cavern Manticore samples score zero or very low detection rates on VirusTotal. That’s a clear sign the group has invested heavily in evasion techniques.
Technical Overlaps with MuddyWater and Lyceum
During analysis, Check Point found a communication module (CAV3RN_Http_Module) that uses a webshell-style ASP.NET handler named cac.aspx. It runs on a separate IIS server at one of two attacker-controlled domains.
“The use of victim-side infrastructure to proxy C2 traffic, combined with XOR-based obfuscation, Base64 encoding, and a fixed verb set per backdoor, is consistent with techniques we have previously observed in operations attributed to OilRig subgroup named Lyceum,” the researchers wrote.
The targeting of SysAid servers also aligns with tactics used by MuddyWater, another MOIS-aligned group. WHOIS records for the root domain hospitalinstallation[.]com — used in the campaign — showed it was registered through Fars Data, an Iranian hosting provider.
What This Means for Israeli Defenders
“By decoupling its core infrastructure from mission-specific modules, Cavern Manticore’s operators gain both operational agility and durability under defensive pressure,” Check Point concluded. “This modularity allows them to adjust capabilities per campaign while preserving the underlying framework.”
For Israeli government and IT security teams, the message is clear: this Iran-nexus hacking group is sophisticated, well-resourced, and actively targeting critical infrastructure. Defenders should scrutinize RMM tools, restrict browser-based remote desktop features, and monitor for unusual SysAid update activity.
The group’s low detection rate on VirusTotal also suggests that signature-based defenses alone won’t cut it. Behavioral monitoring and network anomaly detection may offer a better chance of catching Cavern Manticore before it completes its mission.
