Cavern Manticore Malware Uses Low

Gbhackers •Mayura Kathir • July 7, 2026

A newly identified Iran-linked threat group, tracked as Cavern Manticore, is deploying a sophisticated modular command-and-control (C2) framework built on a shared .NET foundation to conduct stealthy reconnaissance and lateral movement against Israeli government and IT organizations. The group’s custom C2 components exhibit extremely low detection rates on public sandboxes, enabling persistent access while evading […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APT Groups Target Israeli Organizations with Modular C2 Frameworks In 2026, Iranian APT groups, notably Cavern Manticore and OilRig, have intensified cyber operations against Israeli organizations, primarily in the IT and government sectors. Cavern Manticore employs a modular command-and-control (C2) framework built on a .NET foundation, utilizing various compilation formats to evade detection. The attacks often exploit vulnerabilities in legitimate software, such as SysAid, to deploy trojanized DLLs that enable further exploitation. The OilRig group has been active since 2014, previously targeting similar sectors with custom malware like the Solar and Mango backdoors. The campaigns have been characterized by their focus on reconnaissance, data theft, and lateral movement within compromised networks. Both groups are linked to Iran's Ministry of Intelligence and Security, highlighting the geopolitical implications of these cyber operations. Current assessments indicate that these threats are ongoing, with significant risks to Israeli infrastructure. 7 sources 76

Extracted Entities

Cavern Manticore Malware Uses Low

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)