[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBmqAws6iJIBmdMaFkrlDNDbuN4yBhcrs0rEt02FDVZk":3},{"article":4,"iocs":55,"watch_terms":87,"solutions":88,"lesson":183},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"ef26a68d-6653-4b9a-9cc4-221f2804ac34","Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations","iran-linked-hackers-use-new-cavern-c2-framework-to-target-israeli-organizations-de5451","An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations. The activity, which has primarily singled out IT providers and government sectors, has been attributed to a threat cluster tracked by Check Point Research","An Iranian MOIS-affiliated hacking group is employing a new modular C2 framework called Cavern to target Israeli IT providers and government entities. The framework utilizes diverse .NET compilation formats for anti-analysis and offers tailored modules for reconnaissance, data theft, and lateral movement. The attackers have been observed leveraging SysAid's software update feature for initial access and have used supply chain tactics by compromising IT providers to reach their ultimate targets.","Iran-linked hackers use new Cavern C2 framework targeting Israeli organizations.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Firan-linked-hackers-use-new-cavern-c2.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj80nucNUGoxxOtE3SUY1SkDSu77qENrl96c2MUoLWdwAo3ZVoA4FS2QfOdM9c5bsZUJdX1ZxIsXgu7pvVfUzXz3GMZJHmblFTjv5C08dbxvLqXol72iHaD-zH950EZdXUCS-b7F2T-bn8SgqQb9nXA-uOPIaX5V0eaNNmKlQJfWHAKaPAhqsgNL0wTgJH6\u002Fs1600\u002Fcavern.jpg","2026-07-06T18:34:26+00:00","2026-07-06T20:00:10.176688+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Cavern Manticore","threat_actor",{"name":21,"type":22},"Check Point Research","vendor",{"name":24,"type":25},"SysAid","product",{"name":27,"type":19},"MuddyWater",{"name":29,"type":19},"Lyceum",{"name":31,"type":19},"OilRig","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72,75,78,81,84],{"type":57,"value":58,"context":59},"domain","hospitalinstallation[.]com","Cavern C2 server domain",{"type":36,"value":61,"context":62},"Cavern Agent","Core component of the C2 framework",{"type":36,"value":64,"context":65},"Cavern modules","Post-exploitation functionality modules",{"type":36,"value":67,"context":68},"uxtheme.dll","Trojanized DLL used for initial execution",{"type":36,"value":70,"context":71},"n-HTCommp.dll","Communication DLL module",{"type":36,"value":73,"context":74},"mhm.dll","File operations module",{"type":36,"value":76,"context":77},"db.dll","SQL database module",{"type":36,"value":79,"context":80},"ode.dll","Active Directory reconnaissance module",{"type":36,"value":82,"context":83},"n-ten.dll","Network reconnaissance module",{"type":36,"value":85,"context":86},"n-sws.dll","SOCKS5 proxy and WebSocket tunneling module",[21,24],{"controls":89,"vendors":176},[90,118,147],{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,110],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":91,"product_name":107,"url":108,"description":109},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":148,"name":149,"problem":150,"products":151},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[152,160,168],{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":161,"vendor_name":162,"vendor_logo":163,"product_slug":164,"product_name":165,"url":166,"description":167},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":169,"vendor_name":170,"vendor_logo":171,"product_slug":172,"product_name":173,"url":174,"description":175},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[177],{"slug":178,"name":179,"logo_path":180,"roles":181},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[182],"reported_by",{"slug":184,"title":185,"body":186,"framework_refs":187,"framework_notes":200},"iranian-hackers-exploit-sysaid-updates-and-it-providers-to-infiltrate-israeli-targets","Iranian Hackers Exploit SysAid Updates and IT Providers to Infiltrate Israeli Targets","The Cavern C2 campaign highlights how threat actors chain supply chain compromise with software update abuse to achieve deep access into high-value targets. By first compromising IT service providers, attackers gain trusted footholds that allow them to pivot to government and critical infrastructure clients with minimal friction. The exploitation of SysAid's update mechanism underscores how legitimate software channels can become weaponized when not properly monitored or integrity-checked. Organizations that implicitly trust their managed service providers or vendor update pipelines without verification are especially vulnerable to this style of multi-stage intrusion.",[188,189,190,191,192,193,194,195,196,197,198,199],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST CSF ID.SC-4: Supply Chain Risk Management","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST AC-17: Remote Access Controls","NIST SI-7: Software, Firmware, and Information Integrity","NIST DE.CM-1: Network Continuous Monitoring","MITRE ATT&CK T1195.002: Compromise Software Supply Chain","MITRE ATT&CK T1072: Software Deployment Tools","ISO\u002FIEC 27001 A.15.1: Information Security in Supplier Relationships","ITIL Service Transition: Change and Release Management",{}]