Loading story…
Check Point Research disclosed Cavern, a modular .NET command-and-control framework used by the Iran-nexus threat actor Cavern Manticore in intrusions targeting Israeli organizations, particularly in the government and IT sectors. The malware was built to hinder analysis by supporting multiple compilation formats, including IL-only .NET Framework, Mixed-Mode C++/CLI, and NativeAOT, while its modules enable file and database access, LDAP reconnaissance, network discovery, SMB brute-force activity, and SOCKS5/WebSocket tunneling.
In observed attacks, the operators gained initial access by abusing existing remote monitoring and management (RMM) software and, in one execution chain, used SysAid’s software update feature to deploy a WinDirStat DLL sideloading package that loaded a trojanized uxtheme.dll agent. Researchers said the malware uses per-module AppDomain isolation, numbered self-updates, startup cleanup, and low-detection binaries to reduce forensic visibility and improve flexibility, and they linked the framework to older Cav3rn samples and infrastructure overlaps consistent with Iranian MOIS-linked activity associated with Lyceum and MuddyWater.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported a newly identified Project CAV3RN communication module, AzureCommunication.dll, used in cyberespionage operations targeting entities in Israel. The module uses Microsoft Graph and Outlook calendar events for command-and-control, with a DNS AAAA-based fallback recovery mechanism, and Kaspersky assessed with low confidence that the activity is associated with OilRig (APT34).
Check Point Research reported that the Iran-nexus threat actor Cavern Manticore used the modular .NET-based Cavern command-and-control framework in intrusions against Israeli organizations, particularly in the government and IT sectors. In observed cases, the operators gained initial access by abusing existing remote monitoring and management software and in one execution chain used SysAid's software update feature to deploy a WinDirStat DLL sideloading package that loaded a trojanized uxtheme.dll agent.
Check Point identified continuity between the newer modular Cavern framework and older non-modular 'Cav3rn' samples. The researchers said infrastructure and development artifacts support attribution to Iranian MOIS-linked activity with overlaps to Lyceum and MuddyWater.
Kaspersky said it had tracked Project CAV3RN since December 2025 and observed it evolve by April 2026 from a simple downloader-executor-uploader chain into a controller-and-plugin architecture. This shows the framework's maturation before the later disclosure of the AzureCommunication.dll Outlook calendar communication module.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
13 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalware.news
Open sourcecyberveille.ch
Open sourcesecurelist.com
Open sourceresearch.checkpoint.com
Open sourcewelivesecurity.com
Open sourcewelivesecurity.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Iran-linked threat group tracked as **Screening Serpens**—also known as `UNC1549`, `Smoke Sandstorm`, and `Iranian Dream Job`—ran coordinated cyberespionage operations against organizations in the United States, Israel, the United Arab Emirates, and likely two additional Middle Eastern targets. The activity, observed between February and April 2026, relied on highly tailored recruitment- and meeting-themed social engineering aimed largely at technology-sector professionals as regional tensions escalated in the Middle East. Researchers said the group deployed six new remote-access trojan variants across two malware families, **MiniUpdate** and **MiniJunk V2**, using **DLL sideloading** and Azure-hosted command-and-control infrastructure dedicated to individual targets or malware variants. A notable shift in tradecraft was the use of **AppDomainManager hijacking** in .NET applications, allowing the attackers to disable ETW and other security controls through legitimate configuration files before the host application launched. **MiniUpdate** supported command execution, DLL loading, process control, file theft, UAC elevation, and scheduled-task persistence, while **MiniJunk V2** used staged loaders, junk padding, and heavy obfuscation to hinder analysis and detection.
Jun 29, 2026
Security researchers and government analysts said the Iranian state-linked **MuddyWater** group continued broad cyberespionage operations across the Middle East and nearby regions while evolving its malware and command-and-control infrastructure. Recent reporting tied the actor to a previously unreported Go-based C2 framework, **MuddyC2Go**, which appears to have replaced older **PhonyC2** infrastructure after source code leaks and has been active since at least 2020. Campaigns linked to the framework targeted a Jordanian company, an Iraqi telecommunications provider, and likely Israeli organizations, while earlier activity hit government, telecom, and intergovernmental entities in Turkey, Jordan, Iraq, Georgia, Azerbaijan, Armenia, Pakistan, and other regional states through spearphishing, malicious archives, macro-enabled Office files, PDFs, and PowerShell-heavy loaders. Across multiple campaigns, MuddyWater used a shifting toolset that included **POWGOOP**, **Canopy/Starwhale**, **Mori**, **ForeLord**, **POWERSTATS**, **Covicli**, lightweight VBS first-stage malware, DNS-tunneling RATs, ASP.NET web shells, and tunneling utilities such as **SSF** and **Ligolo**. Analysts also linked the group to exploitation of **`CVE-2020-0688`** and possible use of **`CVE-2020-1472`** in operations against Israeli targets, including an intrusion assessed as potentially destructive through deployment of PowGoop and a Thanos-based wiper-like payload disguised as ransomware. Despite changes in malware families and infrastructure, reports consistently described the actor as relying heavily on **PowerShell**, credential theft, persistence via registry keys or scheduled tasks, and rapidly changing C2 servers, underscoring a sustained Iranian espionage capability with occasional escalation toward disruptive effects.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026