A sophisticated Iran-nexus threat actor tracked as Cavern Manticore has deployed a new modular command-and-control framework to infiltrate Israeli IT and government networks.
The attackers abuse trusted remote management software to trigger a DLL sideloading chain that bypasses conventional security defenses.
The targeted attack begins when hackers exploit the SysAid software update feature to drop a malicious package disguised as the legitimate WinDirStat.exe application.
When this application executes, it unknowingly loads a trojanized version of uxtheme.dll, which functions as the core Cavern Agent backdoor.
This malicious DLL exports 83 functions mimicking the Windows theming library, deliberately hiding its true capabilities behind a single active export to evade automated analysis.
uxtheme Sideloading Deploys Cavern
To further disrupt forensic investigations, the developers of the Cavern framework compiled its various operational components into three distinct binary formats.
This strategic architectural decision forces reverse engineers to constantly switch between decompilation toolchains, creating a highly effective anti-analysis layer.
| Component Name | Internal Role | Compilation Format |
|---|---|---|
uxtheme.dll | Cavern Agent backdoor | Mixed-Mode C++/CLI |
n-HTCommp.dll | Network communications | NativeAOT (.NET 8) |
mhm.dll | File management | .NET Framework 4.7.2 |
Once active, the primary agent loads the NativeAOT communication module to establish encrypted server connections using deceptive domains like google.com.hospitalinstallation.com.
The malware dynamically pulls down secondary post-exploitation payloads for SQL database enumeration, Active Directory credential testing, and encrypted data exfiltration.
To actively evade memory forensics, the framework executes each payload within a dedicated, temporary memory domain that is cleanly unloaded immediately after the task finishes, checkpoint said.
Cavern Manticore’s reliance on abused administrative channels emphasizes the critical need to secure trusted supply chains.
Security teams should actively monitor networks for unusual DLL search patterns and hunt for unsigned binaries running from unexpected system locations.
Defenders must prioritize behavioral monitoring over static signatures to rapidly detect lateral movement originating from trusted IT suppliers.
The emergence of the modular Cavern framework highlights how state-sponsored actors like Cavern Manticore are continuously evolving to defeat modern security stacks.
By abusing legitimate software updates from tools like SysAid and employing complex multi-format compilation layers, these attackers significantly raise the cost and effort required for effective reverse engineering.
To thwart these highly adaptable threats, organizations must shift toward proactive behavioral monitoring and closely audit the execution paths of all authorized remote management applications within their environments.
Indicators of Compromise
| SHA-256 | Component |
|---|---|
37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066 | uxtheme.dll (Cavern Agent, build 02) |
92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b | uxtheme.dll (Cavern Agent, build 04) |
5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18 | uxtheme.dll (Cavern Agent, oldest) |
a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41 | n-HTCommp.dll (communication module) |
b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86 | n-HTCommp.dll (communication module) |
8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134 | mhm.dll (file manager module) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
