TLDR Tech / InfoSec
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
Check Point Research attributes Cavern Manticore, an Iran MOIS-linked actor tied to the OilRig subgroup Lyceum, to intrusions against Israeli government and IT targets that begin with RMM and SysAid software-update abuse, then sideload a trojanized uxtheme.dll (Cavern Agent) via the legitimate WinDirStat.exe to establish a modular .NET C2 built across three compilation formats for anti-analysis, with per-module AppDomain isolation and startup directory wipes for anti-forensics. Post-exploitation modules pull LDAP/AD enumeration and brute-forcing, SQL database access, DPAPI credential decryption, SMB share/credential attacks, and SOCKS5/WebSocket tunneling, communicating over XOR-keyed (key 0x48) HTTPS/WSS traffic to C2 domains including auth[.]hospitalinstallation[.]com and google[.]com[.]hospitalinstallation[.]com. Defenders should audit for uxtheme.dll sideloading and unsigned binaries under C:\ProgramData, monitor RMM tooling for anomalous deployment activity, and flag the fixed Edge-spoofed User-Agent and X-User-token header pattern as host-based detection points.
Read the full story