Cavern Manticore: Unmasking Iran’s NET Modular C2 Framework Targeting Israeli Infrastructure + Video

By /

Listen to this Post

Featured Image

Introduction:

The cyber threat landscape has witnessed a significant escalation with the emergence of Cavern Manticore, an Iran-linked threat group operating with a sophisticated, low-detection modular framework. Active since early 2026, this group has launched focused campaigns against Israeli government, defense, and IT organizations, leveraging a shared .NET foundation to conduct stealthy reconnaissance and lateral movement. Attributed to Iran’s Ministry of Intelligence and Security (MOIS) due to technical overlaps with known actors like MuddyWater and the OilRig sub-group Lyceum, Cavern Manticore represents a maturation of state-sponsored cyber capabilities.

Learning Objectives:

  • Understand the architectural components and operational mechanics of the Cavern Manticore modular C2 framework.
  • Identify the specific TTPs (Tactics, Techniques, and Procedures) used for evasion, reconnaissance, and lateral movement.
  • Learn to implement detection strategies and hardening measures against .NET-based modular threats and infrastructure abuse.

You Should Know:

1. Dissecting the Cavern Framework: Agent and Modules

The Cavern framework is built on a shared .NET foundation, comprising two core components designed for operational agility and forensic resistance. The Cavern agent acts as a persistent backdoor, maintaining encrypted communication with attacker-controlled servers. To complicate static analysis and reduce signature-based detection, it leverages multiple .NET compilation strategies including standard .NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT. The initial infection chain often begins with a legitimate binary, WinDirStat.exe, which loads a trojanized `uxtheme.dll` (the Cavern Agent). This agent subsequently loads a dedicated native communication module, n-HTCommp.dll, to establish C2 connectivity.

The second component, Cavern modules, are specialized post-exploitation payloads compiled separately for each victim. These modules handle reconnaissance, credential theft, tunneling, and lateral movement, with capabilities dynamically loaded via per-module AppDomain isolation. This design ensures that even if a single module is discovered, the full functionality remains obscured, making forensic recovery of the complete toolkit from one host infeasible.

Step‑by‑step guide explaining what this does and how to use it (for defensive analysis):

To analyze this modular architecture, defenders can simulate the loading process:

  1. Monitor Process Creation: Use Sysmon (Event ID 1) or Windows Event Logs to track the execution of `WinDirStat.exe` and subsequent child processes. 
    PowerShell command to query Sysmon events for WinDirStat.exe
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} | Where-Object {$_.Message -like "WinDirStat.exe"}
  2. Track DLL Loads: Enable DLL load monitoring (Sysmon Event ID 7) to detect the loading of `uxtheme.dll` from non-standard paths (e.g., the application directory) and the subsequent load of n-HTCommp.dll. 
    PowerShell to filter Sysmon Event 7 for the specific DLLs
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=7} | Where-Object {$<em>.Message -like "uxtheme.dll" -or $</em>.Message -like "n-HTCommp.dll"}
  3. AppDomain Analysis: Use Process Explorer or custom .NET tracing to monitor for unexpected AppDomain creation in non-development contexts. A sudden creation of new AppDomains by a .NET process can be a red flag. 
    // C code snippet to enumerate AppDomains in a process (for analysis tools)
foreach (System.AppDomain domain in System.AppDomain.GetCurrentDomain().GetAssemblies()) {
Console.WriteLine(domain.FriendlyName);
}
  4. Network Baseline: Establish a baseline of network traffic to IIS-hosted ASP.NET handlers. Flag unusual Base64-encoded POST requests to unknown or newly registered domains. 
    Linux command to monitor HTTP POST requests with large Base64 payloads
sudo tcpdump -i any -A -s 0 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' | grep -E "POST|Base64"

2. Initial Access and C2 Communication

Initial access is typically achieved by abusing remote monitoring and management (RMM) tools or browser-based remote desktop features. The group activates a malicious SysAid software update to implant its C2 agents. The `CAV3RN_Http_Module` then communicates through a webshell-style ASP.NET handler (cac.aspx) hosted on a separate IIS server. This communication uses XOR obfuscation and Base64 encoding, with a fixed HTTP verb set per backdoor to blend with legitimate traffic. The infrastructure is often tied to Iranian registrars; for instance, the primary campaign domain `hospitalinstallation[.]com` was registered via Fars Data, an Iranian hosting provider.

Step‑by‑step guide for detection and hardening:

  1. Monitor RMM Tools: Create alerts for unusual execution patterns of legitimate RMM tools (e.g., TeamViewer, AnyDesk, Splashtop) that are not part of standard IT operations. 
    PowerShell to hunt for RMM tool processes
Get-Process | Where-Object {$_.ProcessName -match "teamviewer|anydesk|splashtop|logmein|connectwise"}
  2. Inspect SysAid Updates: Monitor the SysAid update directory for unauthorized or unsigned binaries. Implement application whitelisting (e.g., Windows Defender Application Control or AppLocker) to prevent execution of untrusted software. 
    PowerShell to check SysAid directory for new or modified files
$SysAidPath = "C:\Program Files\SysAidServer\"
Get-ChildItem -Path $SysAidPath -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}
  3. Detect Webshell Activity: Configure IIS logging to capture detailed request data. Regularly review logs for requests to `cac.aspx` or similar suspicious ASP.NET handlers. 
    <!-- Example IIS configuration to enable advanced logging -->
<system.webServer>
<httpLogging dontLog="false" logMethod="true" logUriStem="true" logUriQuery="true" />
</system.webServer>
  4. Network Traffic Analysis: Deploy network detection rules to flag HTTP POST requests containing high entropy (Base64-like) data to external domains. Use Zeek (formerly Bro) for advanced network analysis. 
    Zeek script snippet to detect Base64 POST requests (conceptual)
event http_post(c: connection, uri: string, post_data: string) {
if ( |post_data| > 1000 && is_base64(post_data) ) {
print fmt("Potential C2 POST: %s -> %s", c$id$orig_h, uri);
}
}

3. Reconnaissance and Credential Harvesting

Once a foothold is established, Cavern Manticore executes a series of reconnaissance modules. These modules enumerate Active Directory (AD) structures, harvest credentials via LSASS dumping, and profile network topology to identify high-value targets. The LDAP module, ode.dll, interacts with the LDAP server and base DN from `LDAP://RootDSE` when not explicitly supplied, performs paged searches with a page size of 1,000, and always accepts TLS certificates without validation. This insecure TLS behavior is a critical weakness that defenders can exploit for detection.

Step‑by‑step guide for mitigation:

  1. Detect LSASS Access: Monitor for processes, especially non-system processes, attempting to access the LSASS process memory (e.g., via `OpenProcess` with PROCESS_VM_READ). Use Sysmon Event ID 10 (ProcessAccess) with filter on `TargetImage` containing lsass.exe. 
    PowerShell to query Sysmon Event 10 for LSASS access
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=10} | Where-Object {$_.Message -like "lsass.exe"}
  2. Harden LDAP Queries: Enforce LDAP signing and channel binding to prevent man-in-the-middle attacks and unauthorized enumeration. Disable the acceptance of TLS certificates without validation by enforcing strict certificate policies on domain controllers. 
    PowerShell to enforce LDAP signing
Set-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domain,DC=com" -Replace @{"ldapserverintegrity"=2}
  3. Monitor AD Enumeration: Use Windows Event Logs (Event ID 4662 for directory service access) to track unusual or bulk LDAP queries, especially those originating from non-domain controller systems. 
    PowerShell to query for suspicious AD access events
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4662} | Where-Object {$_.Message -like "LDAP"}

4. Lateral Movement and Tunneling

For lateral movement, the group abuses RMM channels and RDP, while leveraging tunneling capabilities embedded within modules like `n-sws.dll` (SOCKS5/WebSocket tunnel module) to reach internal hosts that are not directly exposed. This allows them to pivot through the network, maintaining a low profile by using legitimate protocols for malicious purposes.

Step‑by‑step guide for detection and prevention:

  1. Restrict RDP Access: Implement network-level authentication (NLA) for RDP and restrict RDP access to only authorized jump hosts using firewall rules and Group Policy. 
    PowerShell to enable NLA via Group Policy (Set-ItemProperty)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -1ame "UserAuthentication" -Value 1
  2. Monitor for Tunneling Tools: Deploy network monitoring to detect unusual SOCKS or WebSocket traffic on non-standard ports. Use Zeek to analyze protocol compliance. 
    Zeek command to detect potential SOCKS5 traffic
zeek -r capture.pcap | grep -i socks
  3. Audit RMM Tool Usage: Implement a strict policy for RMM tool usage, including regular audits of tool activity logs and immediate investigation of any unauthorized usage.
  4. Network Segmentation: Segment the network to limit lateral movement. Ensure that critical assets are isolated in separate VLANs with strict access control lists (ACLs).

5. Evasion and Persistence Mechanisms

The group’s custom C2 components exhibit extremely low detection rates on public sandboxes, often scoring zero or near-zero on VirusTotal. This is achieved through a combination of factors: the use of multiple compilation strategies, module-level isolation, and the abuse of legitimate binaries and protocols. Persistence is maintained via scheduled tasks and GPO logon scripts that deploy suspicious payloads.

Step‑by‑step guide for hardening:

  1. Audit Scheduled Tasks: Regularly review scheduled tasks for unknown or suspicious entries. Use PowerShell to export and compare scheduled tasks against a known good baseline. 
    PowerShell to list all scheduled tasks
Get-ScheduledTask | Where-Object {$_.State -1e "Disabled"}
  2. Monitor GPO Logon Scripts: Implement file integrity monitoring (FIM) on the SYSVOL share to detect unauthorized modifications to logon scripts. 
    PowerShell to check for changes in GPO scripts directory
$GPOPath = "\domain.com\SYSVOL\domain.com\Policies\"
Get-ChildItem -Path $GPOPath -Recurse -Include .ps1, .bat, .cmd, .vbs | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)}
  3. Deploy Endpoint Detection and Response (EDR): Utilize EDR solutions that can detect and block suspicious .NET process behavior, such as unexpected AppDomain loads and reflective loading of assemblies.

6. Infrastructure and Attribution

Infrastructure analysis strengthens the attribution to Iran’s MOIS. The primary campaign domain, hospitalinstallation[.]com, was registered via Fars Data, an Iranian hosting provider. C2 traffic patterns mirror Lyceum’s historical use of victim-side proxying and XOR-based obfuscation. Defenders should monitor WHOIS and DNS for newly registered domains tied to Iranian registrars to preempt C2 infrastructure deployment.

Step‑by‑step guide for proactive defense:

  1. Monitor Domain Registrations: Subscribe to threat intelligence feeds that provide alerts for new domain registrations associated with known malicious registrars or patterns.
  2. Analyze DNS Queries: Implement DNS sinkholing and monitor for queries to domains with low reputation or those that are newly registered. 
    Linux command to monitor DNS queries in real-time
sudo tcpdump -i any -s 0 -1 port 53 | grep -E "A\?|AAAA\?"
  3. Block Known IOCs: Block network traffic to and from the known indicators of compromise (IOCs) at the firewall and proxy level. The IOCs include SHA-256 hashes for various Cavern components:
    – `uxtheme.dll` (Agent): 37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066, 92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b, `5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18`
    – `n-HTCommp.dll` (Communication): a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41, `b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86`
    – `mhm.dll` (File Manager): 8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134, `0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8`
    – `db.dll` (SQL Browser): `5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42`
    – `ode.dll` (LDAP/AD): `30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10`
    – `n-ten.dll` (Network Recon): `2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0`
    – `n-sws.dll` (SOCKS5/WebSocket Tunnel): `7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a`

What Undercode Say:

  • Key Takeaway 1: Cavern Manticore’s use of a modular .NET framework with low detection rates signifies a strategic shift towards more resilient and evasive cyber operations by MOIS-aligned groups. The decoupling of core infrastructure from mission-specific modules allows for rapid iteration and resilience against takedowns.
  • Key Takeaway 2: The group’s ability to blend malicious activity with legitimate administrative tools (RMM, SysAid, RDP) and protocols highlights the critical need for organizations to shift from signature-based detection to behavior-based analytics. Monitoring for anomalies in process behavior, AppDomain loads, and network traffic patterns is essential for early detection.

Analysis:

The Cavern Manticore campaign is a clear example of how nation-state actors are refining their tradecraft to bypass traditional security controls. The framework’s design philosophy—prioritizing modularity, evasion, and operational security—makes it a formidable threat. The use of multiple compilation strategies for .NET binaries complicates static analysis, while the per-module AppDomain isolation ensures that detection of one component does not compromise the entire operation. The reliance on RMM and SysAid for initial access is particularly concerning, as these tools are often trusted and whitelisted by security solutions. This underscores the importance of a zero-trust approach, where even trusted tools are continuously monitored for abuse. Organizations in the defense, government, and critical IT sectors must treat this as a high-priority threat and align their detection engineering and incident response strategies accordingly.

Prediction:

  • -1: The sophistication and low detection rate of the Cavern Manticore framework will likely inspire copycat groups and lead to a proliferation of similar .NET-based modular C2 frameworks in the cybercriminal and APT landscapes.
  • -1: We can expect future iterations of the Cavern framework to incorporate more advanced obfuscation techniques, such as control-flow flattening and virtualization, to further evade next-generation antivirus and EDR solutions.
  • +1: The exposure of Cavern Manticore’s TTPs will prompt security vendors to improve their detection capabilities for .NET-based threats, leading to better protection for organizations.
  • -1: The group’s focus on Israeli targets may intensify, potentially expanding to include other geopolitical adversaries, and could be used in future hybrid warfare operations.
  • +1: The detailed analysis and IOCs provided by researchers will enable defenders to proactively hunt for and mitigate this threat, potentially disrupting ongoing and future campaigns.
  • -1: The abuse of legitimate RMM tools and software update mechanisms highlights a persistent challenge for defenders, as it requires a delicate balance between operational efficiency and security, which many organizations may struggle to maintain.

▶️ Related Video (86% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Mayura Kathiresh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: