[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqaJwTFKIlOxad6NRE1jORziGzObDtps5DAE7CVvwOUc":3},{"article":4,"iocs":54,"watch_terms":83,"solutions":84,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d651e435-054f-4b0a-a0dd-1170a7d36d1b","Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks","iran-linked-hackers-using-modular-c-c-framework-in-cyberattacks-e28a41","Researchers say the Iran-linked threat actor used an adaptable modular malware framework and compromised IT service providers to reach high-value targets in Israel. The post Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks appeared first on SecurityWeek.","An Iran-linked APT group, Cavern Manticore, is employing a sophisticated, modular .NET C&C framework to target organizations in Israel, particularly government entities and IT service providers. The framework utilizes unique compilation formats as an anti-analysis layer and allows for tailored deployments. The attackers have been observed compromising IT service providers to gain access to their clients, demonstrating a deep understanding of complex supply chains.","Iran-linked APT uses modular C&C framework and IT providers to target Israeli organizations.","https:\u002F\u002Fwww.securityweek.com\u002Firan-linked-hackers-using-modular-cc-framework-in-cyberattacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002FIran-Saudi-Arabia-Middle-East-Egypt-Israel.jpeg","2026-07-07T12:21:56+00:00","2026-07-07T14:01:01.863536+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Cavern Manticore","threat_actor",{"name":21,"type":19},"OilRig",{"name":23,"type":19},"Lyceum",{"name":25,"type":19},"Hexane",{"name":27,"type":19},"SiameseKitten",{"name":29,"type":30},"SysAid","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62,65,68,71,74,77,80],{"type":48,"value":56,"context":57},"Cavern agent","Malware agent used in the attack chain",{"type":59,"value":60,"context":61},"mitre_attack","T1071.001","Application Layer Protocol: Web Protocols (used for C2 communication)",{"type":59,"value":63,"context":64},"T1059.001","Command and Scripting Interpreter: PowerShell (implied by .NET framework)",{"type":59,"value":66,"context":67},"T1570","Lateral Tool Transfer (use of modules)",{"type":59,"value":69,"context":70},"T1021.001","Remote Services: Remote Desktop Protocol (used for access)",{"type":59,"value":72,"context":73},"T1041","Exfiltration Over C2 Channel (implied by module functionality)",{"type":59,"value":75,"context":76},"T1003","OS Credential Dumping (LDAP brute-force module)",{"type":59,"value":78,"context":79},"T1566.002","Phishing: Spearphishing Link (implied by initial compromise vector)",{"type":59,"value":81,"context":82},"T1190","Exploit Public-Facing Application (abuse of SysAid software update feature)",[29],{"controls":85,"vendors":172},[86,114,143],{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,98,106],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":87,"product_name":95,"url":96,"description":97},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":144,"name":145,"problem":146,"products":147},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[148,156,164],{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[173],{"slug":174,"name":175,"logo_path":176,"roles":177},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[178],"reported_by",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":197},"iran-linked-apt-exploits-it-supply-chain-with-modular-cc-framework","Iran-Linked APT Exploits IT Supply Chain with Modular C&C Framework","The Cavern Manticore APT group is leveraging trusted relationships between IT service providers and their government\u002Fenterprise clients to gain lateral access — a classic supply chain attack vector. The use of a modular .NET C&C framework with unique compilation formats specifically designed to evade analysis tools demonstrates a high level of operational sophistication. This matters because compromising a single IT provider can cascade into breaches across dozens of client organizations simultaneously. The anti-analysis techniques employed also highlight the growing challenge defenders face in detecting and reverse-engineering modern malware. Organizations that implicitly trust their managed service providers without enforcing segmentation or monitoring are especially vulnerable.",[184,185,186,187,188,189,190,191,192,193,194,195,196],"CIS Control 3: Data Protection","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management","NIST SR-6: Supplier Assessments and Reviews","NIST AC-17: Remote Access","NIST SI-4: System Monitoring","NIST CA-3: Information Exchange","MITRE ATT&CK T1199: Trusted Relationship","MITRE ATT&CK T1071: Application Layer Protocol (C&C)","ISO\u002FIEC 27036: Information Security for Supplier Relationships","NIST Zero Trust Architecture SP 800-207",{}]