MalwareUsed by 4 actors

Cavern

Cavern, also known as Cav3rn, is a modular .NET-based post-exploitation command-and-control framework associated with Iranian state-linked intrusion activity targeting organizations in Israel, particularly government entities and IT service providers. The framework has been linked to the threat cluster tracked as Cavern Manticore, which has been assessed as affiliated with Iran’s Ministry of Intelligence and Security, with reported tradecraft overlaps to MuddyWater and Lyceum. Some reporting also links later Cavern-related activity to OilRig with low confidence.

Cavern is designed as an extensible toolkit composed of an agent and interchangeable modules that can be deployed according to mission requirements. Documented modules support file operations, SQL database enumeration and export, Active Directory and LDAP reconnaissance, LDAP and SMB brute-force activity, network reconnaissance and port scanning, SOCKS5 proxying, and WebSocket tunneling. The framework separates communications from operational plugins and uses multiple .NET compilation models, including .NET Framework, mixed-mode C++/CLI, and NativeAOT, to complicate analysis. Reported anti-analysis and anti-forensics features include AppDomain isolation for managed modules, runtime cleanup of working directories, export spoofing, and mixed compilation formats rather than conventional packer-based obfuscation.

Observed intrusion chains used abuse of SysAid’s software update mechanism to deliver a DLL sideloading package that executed the Cavern agent through a trojanized dependency loaded by a legitimate application. After execution, the agent established command-and-control and retrieved additional modules for follow-on activity. Operators were also reported to abuse legitimate remote monitoring and management tools, browser-based remote desktop access, and trusted provider relationships to move laterally through compromised environments and, in some cases, pivot through multiple IT providers to reach intended Israeli targets.

Cavern has continued to evolve. Newly documented communication components include modules that can dynamically choose between direct HTTPS and relayed communications through legitimate cloud services, as well as broker functionality for loading DLL components, routing messages, and supporting runtime upgrades. A related Cavern-linked implant, HollowGraph, has been assessed with high confidence as part of the framework and demonstrates the ecosystem’s emphasis on stealth by abusing Microsoft 365 calendars and the Microsoft Graph API as a covert bidirectional command-and-control and exfiltration channel, while using DNS-based credential refresh to sustain access. Across reporting, Cavern is consistently characterized as an espionage-oriented framework built for stealthy, tailored post-compromise operations in targeted environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

OilRig

Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel.

via the hacker newsthehackernews.com

HEXANE

via the hacker newsthehackernews.com

Cavern Manticore

via the hacker newsthehackernews.com

MuddyWater

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence2

The malware uses hardcoded credentials to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account.

Persistence

1 technique

T1078Valid AccountsEvidence2

The malware uses hardcoded credentials to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence2

The malware uses hardcoded credentials to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account.

Stealth

4 techniques

T1027.003SteganographyEvidence1

To remain under the radar, the threat actor creates calendar events dated May 13, 2050, with the title in specific formats. Commands and exfiltrated data are concealed within files attached to these calendar entries.

T1036MasqueradingEvidence3

The configuration file is stored as logAzure.txt to appear as a regular log file.

T1078Valid AccountsEvidence2

The malware uses hardcoded credentials to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account.

T1564.001Hidden Files and DirectoriesEvidence1

which it then writes to a configuration file on disk disguised as an ordinary log file, logAzure.txt.

Credential Access

3 techniques

T1110Brute ForceEvidence1

The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling.

T1555Credentials from Password StoresEvidence1

to retrieve updated tenant IDs, client IDs, client secrets, and mailbox details, which it then writes to a configuration file on disk disguised as an ordinary log file, logAzure.txt.

T1649Steal or Forge Authentication CertificatesEvidence1

Group-IB also recommends restricting and auditing OAuth2 apps that use client credentials, and setting up alerts when new client secrets get created.

Discovery

2 techniques

T1018Remote System DiscoveryEvidence1

The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling.

T1046Network Service DiscoveryEvidence1

The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling.

Collection

1 technique

T1074Data StagedEvidence1

Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later.

Command and Control

9 techniques

T1071Application Layer ProtocolEvidence12

HTTP/HTTPS-based C2 communication... were repeatedly observed.

T1071.001Web ProtocolsEvidence2

The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction.

T1071.004DNSEvidence8

The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction.

T1090ProxyEvidence1

The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling.

T1102Web ServiceEvidence2

A newly identified Windows malware sample abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command and control (C2) channel.

T1102.001Dead Drop ResolverEvidence2

Researchers note that the mailbox calendars are used as a “dead drop” to store the data; hence, HollowGraph does not use traditional C2 servers to avoid detection.

T1102.002Bidirectional CommunicationEvidence2

Le canal C2 est classifié comme Web Service C2 dans le framework ATT&CK.

T1105Ingress Tool TransferEvidence1

Meanwhile, the get command searches for appointments planted by the operator and downloads the attached instructions.

T1572Protocol TunnelingEvidence1

The modules facilitate file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5 proxy and WebSocket tunneling.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence3

The send command generates calendar appointments with encrypted stolen files attached.

T1048Exfiltration Over Alternative ProtocolEvidence2

The SEND type of events is used to exfiltrate the stolen data by adding it as an attachment.

T1567Exfiltration Over Web ServiceEvidence1

operators plant instructions by creating calendar events, and the malware exfiltrates stolen files by creating its own events with encrypted attachments.

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

domain●●●●●●●●●●●●View more in app18 days ago

hash.sha256●●●●●●●●●●●●View more in app27 days ago

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

21 SOURCESView more in app

the hacker newsNews

Aug 17, 2026

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

A modular command-and-control framework used in post-exploitation operations. It includes an agent and multiple plugins/modules for file operations, SQL database enumeration, Active Directory reconnaissance, LDAP brute-force attacks, network reconnaissance, and SOCKS5/WebSocket tunneling, while emphasizing persistence and low forensic visibility.

security weekNews

Jul 21, 2026

New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication - SecurityWeek

A larger malware/toolkit framework that HollowGraph is believed to be a variant or component of, based on command format and structure.

gurucul threat researchNews

Jul 21, 2026

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels | Community Portal | Gurucul

A malware framework assessed to be linked to HOLLOWGRAPH.

cyberveilleNews

Jul 21, 2026

HollowGraph : un implant espion détourne Microsoft 365 Calendar comme canal C2 via Graph API | CyberVeille

Offensive framework linked in the reporting to HollowGraph and associated by prior research with the Cavern Manticore operator.

+17 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Cavern