An Iranian state-linked group that Check Point Research has named Cavern Manticore is running a modular command-and-control framework against Israeli government and IT-sector organizations, and the way it gets in says as much about enterprise risk as the malware itself.
According to Check Point’s research, published July 6, the group does not lead with a phishing email or an exploited internet-facing box. It abuses remote monitoring and management (RMM) tooling already deployed inside the target, specifically weaponizing SysAid’s software update mechanism to sideload a malicious DLL, then uses IT service providers as a stepping stone into higher-value clients. Check Point links the group’s technical fingerprints, including infrastructure registered through an Iranian hosting provider and code overlaps with the MuddyWater and Lyceum clusters, to Iran’s Ministry of Intelligence and Security.
The framework itself, dubbed Cavern, is built in three separate compilation formats (standard .NET, mixed-mode C++/CLI, and NativeAOT) for the same set of modules, a deliberate anti-analysis choice that forces a defender to switch tooling mid-investigation. Many samples score at or near zero on VirusTotal as a result.
The original insight here is not the framework’s cleverness, it is the access model. Cavern Manticore treats a victim’s own trusted RMM relationship as the door, rather than picking a lock the target controls directly. That is harder for defenders than patching a known CVE, because the “vulnerability” is a legitimate business dependency on a third-party IT provider, not a flaw with a fix. Organizations that outsource IT support inherit whatever access that provider’s tooling has, and Check Point’s telemetry suggests Iranian operators are actively hunting that seam.
Security teams with exposure to Israeli partners, vendors or subsidiaries should audit which third parties hold standing RMM access into their environment, watch for anomalous uxtheme.dll sideloading patterns, and review RMM update logs for unauthorized deployments. This sits alongside the broader trend CyberTech has tracked of attackers moving faster than patch cycles can absorb, applied here to trust relationships instead of software bugs.
Source: Check Point Research
