Check Point Research exposes Cavern Manticore, an Iran MOIS-linked APT group targeting Israeli IT providers and government organizations. The group uses a modular post-exploitation C2 framework called Cavern, built on .NET but deliberately compiled into three different binary formats (.NET Framework IL, Mixed-Mode C++/CLI, and .NET 8 NativeAOT) to force analysts into multiple toolchains. The framework deploys via SysAid software update abuse and DLL sideloading through a trojanized uxtheme.dll. Modules include file management with DPAPI decryption, SQL database browsing, LDAP/AD reconnaissance with brute-force, network recon with SMB credential spraying, and a SOCKS5/WebSocket tunnel. The communication module uses XOR-encrypted HTTPS and WebSocket transport. The research details reverse engineering techniques for NativeAOT binaries, including a ported IDA Pro plugin. Human authorship fingerprints include profanity-laced debug strings, typos, and bespoke naming conventions. The framework evolved from an older 'Cav3rn' monolithic design and is linked to the OilRig subgroup Lyceum based on infrastructure, targeting patterns, and TTP overlaps.
