Introduction
Cavern Manticore is an Iran-linked threat actor targeting Israeli government and IT sector organizations through trusted technology providers and a modular command-and-control framework called Cavern.
Check Point Research reported the campaign in July 2026 after tracking the actor since early 2026. The group focuses on Israeli organizations, especially government entities and IT providers that can serve as bridges into higher-value environments.
The campaign matters because Cavern Manticore does not depend on noisy, direct intrusion alone. It abuses trusted relationships, remote management paths, and provider access to move through supply chains.
The Cavern framework uses a shared .NET foundation, but its components appear in different compilation formats. That design complicates analysis and slows defenders who need to reverse engineer the full toolset.
This article explains how Cavern Manticore operates, how the Cavern C2 framework works, why IT providers create supply chain risk, and what security teams should do now.
For related nation-state coverage, see Digital Warfare’s Russia-linked Turla compromised infrastructure analysis Why Cavern Manticore Matters
Cavern Manticore matters because the campaign shows how state-linked operators can turn normal IT support relationships into espionage paths.
Many government and enterprise organizations rely on managed service providers, IT integrators, remote monitoring tools, and support vendors. Those relationships often require privileged access.
When attackers compromise a provider, they may inherit trusted access into downstream clients.
That changes the risk model. The first victim may not be the real target. The provider may only be the bridge.
For Israeli government and IT organizations, this creates a serious supply chain security problem. For other sectors, it offers a clear warning: vendor access must be monitored like internal privileged access.
What Check Point Research Found
Check Point Research tracks Cavern Manticore as an Iran-nexus threat actor operating against Israeli targets, with a focus on government and IT sectors.
The group shares technical and tactical overlaps with Iranian MOIS-linked actors, including MuddyWater and Lyceum. Lyceum is widely assessed as a subgroup linked to OilRig.
Check Point also identified a previously undocumented modular C2 framework called Cavern, or Cav3rn.
The framework uses .NET components but compiles them into different output formats. This includes standard .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT.
That compilation diversity is important because it forces analysts to use different workflows and tools for different parts of the same framework.
How Cavern Manticore Uses Israeli IT Supply Chains
Cavern Manticore uses supply chain access to reach targets that may be harder to compromise directly.
The actor targets IT providers that serve Israeli organizations. Once inside a trusted provider, it can abuse existing remote access tools, support pathways, and administrative relationships.
Check Point observed cases where compromise moved through more than one provider before reaching the final target.
This second-hop pattern matters. It means defenders cannot secure only their own network and assume vendor access is safe.
A trusted IT provider with broad access can become an attacker-controlled delivery mechanism.
The Cavern C2 Framework
The Cavern C2 framework separates core communication from mission-specific modules.
That modular design gives the operator flexibility. The attacker can deploy only the components needed for a specific environment, then add functions later as the operation develops.
Check Point describes modules that support file system access, SQL database interaction, LDAP and Active Directory queries, network reconnaissance, SOCKS5 tunneling, and WebSocket tunneling.
This gives Cavern Manticore the tools needed for espionage, credential collection, environment mapping, lateral movement, and long-term access.
The framework reflects a mature operational design rather than a one-off malware family.
Why the Compilation Strategy Slows Defenders
Cavern Manticore uses multiple .NET compilation formats as an anti-analysis strategy.
The framework does not rely only on traditional obfuscation. Instead, it creates friction by forcing analysts to work across different compiled forms.
Standard .NET Framework samples can be easier to inspect with common .NET tooling.
Mixed-Mode C++/CLI samples require a different analysis approach because they combine managed and native code.
Native AOT complicates analysis further by removing some metadata that analysts often rely on.
This slows reverse engineering and buys time for the operator.
Cavern Manticore and RMM Abuse
Remote Monitoring and Management tools are a major part of the risk.
RMM platforms are designed to help IT teams manage systems remotely, push updates, run commands, and troubleshoot endpoints. That makes them powerful and trusted.
Cavern Manticore abuses that trust.
If attackers control RMM infrastructure or update paths, they can deliver malicious payloads that look like normal support activity.
This makes detection harder because the traffic and commands may come from tools the organization already allows.
SysAid and Trusted Update Paths
Public reporting links the campaign to abuse of SysAid-related update mechanisms and trusted IT management paths.
This is important because software update workflows often carry broad trust. Administrators expect update traffic from management platforms, and security tools may treat those actions as normal.
Attackers exploit that assumption.
Security teams should review recent updates, software deployments, and unusual child processes tied to RMM or IT management platforms.
They should also confirm that only approved packages can move through management channels.
Post-Exploitation Capabilities
Cavern Manticore’s post-exploitation modules support deep environment discovery.
The framework can query Active Directory, inspect files, browse databases, establish tunnels, and help attackers move through a network.
LDAP and Active Directory queries are especially important because they help attackers understand users, groups, systems, and trust relationships.
SQL access can expose sensitive business or government data.
Tunneling modules help attackers move traffic through the environment while hiding behind trusted hosts.
Enterprise and Government Impact
Cavern Manticore creates serious impact for government organizations, IT providers, and any organization that relies on external administrators.
First, it turns IT providers into risk multipliers. A single provider compromise can create exposure for multiple downstream clients.
Second, it hides inside trusted operations. RMM actions, software updates, and provider access can look legitimate unless teams monitor behavior closely.
Third, it supports persistent espionage. The campaign focuses on intelligence collection, credential access, and long-term visibility rather than quick disruption.
Fourth, it weakens confidence in supply chain trust. Organizations must ask not only whether they are secure, but whether their providers are secure enough for the access they hold.
Why Zero or Low Detection Matters
Check Point and current reporting describe Cavern samples as having zero or very low detection rates in VirusTotal at the time of analysis.
That does not mean the malware is invisible forever. It means signature-based detection may fail during the most important window.
Security teams should not rely only on file reputation, hashes, or antivirus alerts.
Behavior matters more. Unusual RMM deployments, unexpected outbound traffic, abnormal LDAP queries, suspicious tunneling, and strange child processes can reveal the operation even when files do not match known signatures.
Real-World Attack Scenarios
A trusted IT provider scenario starts when Cavern Manticore compromises a managed service provider. The actor uses the provider’s RMM platform to push a malicious update to downstream clients. The clients see activity from a trusted support channel, while the attacker gains access.
A second-hop supply chain scenario starts with a smaller vendor. The actor uses that vendor’s access to reach a larger IT integrator, then uses the integrator’s relationship to reach a government client.
A remote management abuse scenario starts with legitimate administrative tooling. The attacker runs commands, transfers payloads, and moves laterally through tools that already exist in the environment.
A silent espionage scenario starts after deployment. The actor queries Active Directory, inspects files, browses databases, and creates tunnels for long-term collection.
These scenarios reflect the confirmed campaign mechanics and avoid unsupported victim-specific claims.
How to Defend Against Cavern Manticore
Defending against Cavern Manticore requires stronger control over vendor access, remote management tools, and internal behavior monitoring.
Start with RMM visibility. Every remote management action should be logged, reviewed, and tied to a known change or support request.
Next, restrict provider access. Vendors should reach only the systems they support, not broad internal networks.
Then, strengthen behavioral detection. Security teams need alerts for unusual commands, suspicious LDAP queries, unexpected tunnels, and abnormal outbound connections.
Finally, review every provider relationship as part of the security perimeter.
Monitor RMM Tools Like Privileged Access
RMM tools should receive the same monitoring as domain administrator activity.
Security teams should alert on unusual deployment times, unfamiliar source locations, unexpected host groups, new remote sessions, suspicious command execution, and unapproved software pushes.
They should also require strong authentication and strict role separation for RMM accounts.
Provider access should expire when support work ends.
Harden SysAid and IT Management Platforms
Organizations using SysAid or similar platforms should audit update delivery mechanisms.
Review recently delivered packages, update sources, administrator accounts, and child processes created by management tools.
Unexpected launches of cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or script interpreters from IT management processes should trigger investigation.
The goal is not to block legitimate administration. The goal is to detect when trusted tooling behaves like attacker infrastructure.
Deploy Behavioral EDR
Cavern Manticore’s low detection rates show why behavioral EDR matters.
Security teams need endpoint detection that identifies abnormal behavior even when a file has no known signature.
Useful detections include unusual module loading, suspicious .NET execution, abnormal network connections, rare parent-child process chains, credential access behavior, and suspicious tunneling.
EDR should also capture enough telemetry to support forensic reconstruction after a suspected provider compromise.
Segment Vendor Access
Vendor access should be narrow, temporary, and monitored.
IT providers should not have broad access across sensitive systems by default. Segment their access by client, system type, business function, and support role.
Use zero trust access controls, strong MFA, device posture checks, session recording, and just-in-time access where possible.
If a provider is compromised, segmentation limits how far the attacker can move.
Audit Active Directory and LDAP Queries
Cavern modules can query LDAP and Active Directory as part of reconnaissance.
Security teams should monitor for unusual query volume, queries from unexpected systems, bulk group enumeration, service account discovery, and organizational unit mapping.
These actions often precede lateral movement and credential targeting.
Active Directory telemetry can reveal espionage activity even when malware detection fails.
Watch for Suspicious C2 and Tunneling
The Cavern framework supports tunneling and command-and-control activity.
Security teams should monitor unexpected outbound HTTP, WebSocket, and proxy-like traffic from servers that do not normally communicate externally.
Internal web servers, management servers, and RMM infrastructure should have tightly controlled egress.
Block known suspicious domains from vendor reports and investigate any attempted connection from sensitive hosts.
Review Vendor Risk Through vCISO Oversight
This campaign is a vendor-access and governance problem, not only a malware problem.
Digital Warfare’s vCISO services help organizations build governance around third-party access, supply chain risk, executive reporting, security strategy, and incident readiness.
This is the most relevant service-page link for this nation-state supply chain article because the core issue is trusted provider risk and long-term security program oversight.
Assess the Full Supply Chain Attack Surface
Organizations should identify which vendors can access sensitive systems, which tools they use, and which accounts support remote administration.
Digital Warfare’s attack services help organizations emulate attacker behavior and identify weak points across networks, applications, websites, and mobile applications.
For related supply chain threat coverage, see Digital Warfare’s TeamPCP developer tool supply chain analysis
Broader Security Lessons From Cavern Manticore
Cavern Manticore shows that trusted relationships are now primary attack paths.
Organizations often protect their own perimeter while allowing vendors deep access through support tools. Attackers understand that imbalance.
The campaign also shows that malware analysis is no longer enough. Defenders need visibility across identity, RMM tools, vendor sessions, network egress, Active Directory, and endpoint behavior.
Finally, supply chain mapping often happens before intrusion. If attackers know which providers serve which clients, they can design second-hop attacks before they compromise anyone.
Why IT Providers Need Stronger Controls
IT providers carry concentrated risk.
They manage infrastructure for multiple clients, hold administrative access, and often operate tools that bypass normal user restrictions.
If attackers compromise one provider, they may gain paths into many downstream environments.
Providers should treat their own infrastructure as critical infrastructure. Clients should verify provider security instead of assuming it.
Why Signature Detection Is Not Enough
Signature detection fails when attackers use custom tooling, low-prevalence samples, and modular frameworks.
Cavern Manticore shows why defenders need behavior-first detection.
A file may look new or unknown. The behavior may still reveal the attack.
Suspicious RMM deployments, unusual LDAP queries, unexpected tunnels, strange .NET execution, and rare outbound traffic patterns should all matter.
Key Takeaways
Cavern Manticore is an Iran-linked threat actor targeting Israeli government and IT sector organizations.
Check Point Research tracks the group as an Iran-nexus actor with overlaps involving MOIS-linked groups such as MuddyWater and Lyceum.
The actor uses a modular .NET C2 framework called Cavern or Cav3rn.
The framework uses multiple .NET compilation formats, including .NET Framework, Mixed-Mode C++/CLI, and Native AOT, to complicate analysis.
The campaign targets IT providers and trusted remote management paths to reach downstream government organizations.
Security teams should monitor RMM activity, segment vendor access, harden IT management platforms, deploy behavioral EDR, audit Active Directory queries, and monitor unusual egress from sensitive systems.
For the authoritative external reference, review the Check Point Research report on Cavern Manticore
What Organizations Should Do Now
Inventory every RMM and IT management tool.
Review which vendors can access sensitive systems.
Require strong MFA and conditional access for provider accounts.
Limit vendor access to required systems only.
Monitor RMM commands, software pushes, and remote sessions.
Audit SysAid and other management platform update activity.
Deploy behavioral EDR across servers and endpoints.
Monitor LDAP and Active Directory reconnaissance patterns.
Restrict outbound traffic from management servers and sensitive internal systems.
Review vendor incident response obligations and notification timelines.
Frequently Asked Questions About Cavern Manticore
What Is Cavern Manticore?
Cavern Manticore is an Iran-linked threat actor tracked by Check Point Research. The group targets Israeli government and IT sector organizations and uses a modular C2 framework called Cavern or Cav3rn.
Who Is Cavern Manticore Linked To?
Check Point Research links Cavern Manticore to Iran-nexus activity and notes overlaps with MOIS-linked actors including MuddyWater and Lyceum.
What Is the Cavern C2 Framework?
Cavern is a modular .NET command-and-control framework. It separates core communication from mission-specific modules for file access, database interaction, LDAP queries, reconnaissance, SOCKS5 tunneling, and WebSocket tunneling.
Why Is Cavern Manticore Dangerous?
Cavern Manticore is dangerous because it targets trusted IT providers and remote management paths. That allows the actor to reach downstream organizations through relationships defenders may already trust.
How Does Cavern Manticore Avoid Detection?
The framework uses multiple .NET compilation formats, including .NET Framework, Mixed-Mode C++/CLI, and Native AOT. This complicates reverse engineering and can slow analysis.
What Sectors Does Cavern Manticore Target?
Check Point reports that Cavern Manticore focuses on Israeli government and IT sector organizations.
How Should Organizations Defend Against Cavern Manticore?
Organizations should monitor RMM tools, restrict vendor access, harden IT management platforms, deploy behavioral EDR, audit Active Directory queries, and monitor unusual outbound traffic.
Why Does This Campaign Matter Outside Israel?
The campaign matters globally because many organizations rely on IT providers and remote management tools. The same supply chain attack model can affect enterprises, government agencies, and critical infrastructure in any region.
