Loading threat actor…
Cavern Manticore is an Iran-nexus espionage threat cluster assessed with moderate confidence to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS). The actor has been active since at least early 2026 and is primarily associated with intrusions against Israeli organizations, especially government entities and IT service providers. Public reporting also notes technical and operational overlaps with MuddyWater and Lyceum, the latter often described as an OilRig sub-group. Cavern Manticore is best known for operating the modular Cavern, or Cav3rn, command-and-control framework, a .NET-based post-exploitation platform designed for tailored deployments, persistence, reduced forensic visibility, and flexible expansion of capabilities after compromise. The group has relied heavily on trusted-access pathways rather than noisy exploitation chains. Observed operations include abuse of existing remote monitoring and management access, compromise of IT-provider environments to pivot toward downstream victims, and use of browser-based remote desktop technologies. In some intrusions, the actor abused SysAid software deployment and update functionality to deliver a DLL sideloading chain that launched the Cavern agent. Reporting explicitly indicates this activity did not require compromise of SysAid itself or exploitation of a SysAid vulnerability. The actor has also used remote printing features as an alternate exfiltration path when standard clipboard or file-transfer options were constrained. Cavern is structured around a persistent agent and interchangeable modules. The framework uses multiple compilation formats, including .NET Framework, mixed-mode C++/CLI, and NativeAOT, as an anti-analysis measure. Modules documented in public reporting support file operations, host and network reconnaissance, SQL database enumeration and export, Active Directory and LDAP reconnaissance, LDAP and SMB brute-force activity, SOCKS5 proxying, WebSocket tunneling, and other post-exploitation tasks. The framework isolates modules to limit forensic recovery and supports runtime updates, allowing operators to swap or extend functionality while maintaining access. Communications have used HTTP, HTTPS, WebSocket, and relay mechanisms that blend with legitimate traffic, and later Cavern-associated tooling expanded into covert use of cloud services. Cavern Manticore has also been linked to HOLLOWGRAPH, a Cavern-associated espionage implant observed in targeted operations against Israeli organizations. HOLLOWGRAPH abuses Microsoft 365 calendars and the Microsoft Graph API as a bidirectional command-and-control and exfiltration channel, while using DNS-based credential refresh to maintain access to cloud resources. This tradecraft reflects a broader emphasis on stealth, abuse of legitimate services, and post-compromise persistence rather than disruptive or financially motivated operations. Overall, Cavern Manticore is characterized as a state-linked espionage actor focused on government and IT-sector access, supply-chain-style pivoting through service providers, modular post-exploitation, covert command-and-control, reconnaissance, credential-focused network operations, and data theft. Its observed behavior aligns with long-term intelligence collection and access development rather than ransomware or destructive campaigns.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
59 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Leveraging SysAid and remote monitoring and management access to deploy a modular .NET command-and-control framework.
Iran-aligned espionage activity cluster linked to the Cavern/CAV3RN command-and-control framework in attacks targeting entities in Israel. The group uses modular post-exploitation tooling and covert C2 channels to maintain persistence and reduce forensic visibility.
An Iranian hacking crew referenced in connection with the Cavern/Cav3rn framework and the HOLLOWGRAPH malware, which abuses Microsoft Graph API and a compromised Microsoft 365 calendar as a covert two-way command-and-control channel.
Iran-nexus threat actor likely linked to the HollowGraph malware and a broader toolkit/framework.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.