Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework

Cybersecuritynews •Tushar Subhra Dutta • July 7, 2026

A new Iranian-linked hacking group has been caught abusing everyday IT tools to slip malware onto Israeli networks. Researchers have named the group Cavern Manticore, and its latest campaign shows how creative attackers have become at hiding in plain sight. Instead of flashy exploits, the group leans on software organizations already trust. At the heart […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APT Groups Target Israeli Organizations with Modular C2 Frameworks In 2026, Iranian APT groups, notably Cavern Manticore and OilRig, have intensified cyber operations against Israeli organizations, primarily in the IT and government sectors. Cavern Manticore employs a modular command-and-control (C2) framework built on a .NET foundation, utilizing various compilation formats to evade detection. The attacks often exploit vulnerabilities in legitimate software, such as SysAid, to deploy trojanized DLLs that enable further exploitation. The OilRig group has been active since 2014, previously targeting similar sectors with custom malware like the Solar and Mango backdoors. The campaigns have been characterized by their focus on reconnaissance, data theft, and lateral movement within compromised networks. Both groups are linked to Iran's Ministry of Intelligence and Security, highlighting the geopolitical implications of these cyber operations. Current assessments indicate that these threats are ongoing, with significant risks to Israeli infrastructure. 10 sources 76

Extracted Entities

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (2)