Iran-Linked Cavern C2 Framework Hits Israeli Orgs via SysAid

An Iranian threat cluster linked to the Ministry of Intelligence and Security (MOIS) is using a previously undocumented modular command-and-control framework dubbed Cavern (aka Cav3rn) to target Israeli IT providers and government entities. Tracked by Check Point Research as Cavern Manticore, the group shares tactical overlaps with MuddyWater and Lyceum, the latter considered a sub-group of OilRig. The framework is built around a shared .NET foundation but leverages multiple compilation formats—including .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT—turning compilation diversity itself into an anti-analysis layer that forces reverse engineers into fragmented metadata-reconstruction workflows.

The attack chain begins with abuse of SysAid's software update feature, which delivers a trojanized DLL ("uxtheme.dll") via DLL side-loading. This Cavern Agent loads a standalone communication module ("n-HTCommp.dll") to beacon the C2 server at hospitalinstallation[.]com and fetch post-exploitation modules on the fly over HTTPS or WebSocket. Security teams investigating the indicator can use a WHOIS lookup to trace registration details on the malicious domain, and run an SSL/TLS checker against any related infrastructure to validate certificate provenance and identify lookalike certificates.

Cavern's architecture cleanly divides core communication (Agent) from mission-specific modules, enabling tailored deployments that reduce forensic visibility. At least five DLL modules have been recovered: mhm.dll handles file operations, recursive search, archiving, and bidirectional transfers; db.dll manages SQL database enumeration, query, and manipulation; ode.dll performs Active Directory reconnaissance, user/group enumeration, and LDAP brute-force attempts; n-ten.dll conducts port scanning, share enumeration, and SMB brute-force; and n-sws.dll supports SOCKS5 proxy and WebSocket tunneling. Operators can pull these modules on demand for reconnaissance, data theft, tunneling, and lateral movement, ensuring persistent, profile-specific access.

Notably, mhm.dll, db.dll, and ode.dll are compiled as pure .NET Framework assemblies, while n-HTCommp.dll, n-ten.dll, and n-sws.dll use Native AOT compilation for lighter, harder-to-reverse binaries; the main agent mixes managed .NET with native C++ inside a single portable executable containing a unified module dispatcher. Defenders are urged to audit SysAid deployments for the side-loading artifacts, hunt for the named DLLs and the hospitalinstallation[.]com C2 indicator, and validate network exposure with a port scanner to identify any unexpectedly opened SMB, LDAP, or tunneling endpoints in affected environments.