Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
Iran-linked hackers use new Cavern C2 framework targeting Israeli organizations.
An Iranian MOIS-affiliated hacking group is employing a new modular C2 framework called Cavern to target Israeli IT providers and government entities. The framework utilizes diverse .NET compilation formats for anti-analysis and offers tailored modules for reconnaissance, data theft, and lateral movement. The attackers have been observed leveraging SysAid's software update feature for initial access and have used supply chain tactics by compromising IT providers to reach their ultimate targets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Check Point Research?
Get an email when a new story names Check Point Research, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cavern C2 campaign highlights how threat actors chain supply chain compromise with software update abuse to achieve deep access into high-value targets. By first compromising IT service providers, attackers gain trusted footholds that allow them to pivot to government and critical infrastructure clients with minimal friction. The exploitation of SysAid's update mechanism underscores how legitimate software channels can become weaponized when not properly monitored or integrity-checked. Organizations that implicitly trust their managed service providers or vendor update pipelines without verification are especially vulnerable to this style of multi-stage intrusion.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — hospitalinstallation[.]com
- malware — Cavern Agent
- malware — Cavern modules
- malware — uxtheme.dll
- malware — n-HTCommp.dll
- malware — mhm.dll
- malware — db.dll
- malware — ode.dll
- malware — n-ten.dll
- malware — n-sws.dll