Loading threat actor…
Cavern Manticore is an Iran-nexus espionage threat cluster assessed with moderate confidence to be linked to Iran’s Ministry of Intelligence and Security (MOIS). The actor has been active since at least early 2026 and has primarily targeted Israeli organizations, especially government entities and IT service providers. Reporting also indicates access to defense-sector environments. The cluster shows technical and operational overlap with the Iranian groups MuddyWater and Lyceum, and the Cavern framework has also been referred to as Cav3rn. The group is notable for abusing trusted administration pathways rather than relying solely on direct exploitation. Observed intrusions used existing remote monitoring and management access, compromised IT-provider environments, browser-based remote desktop technologies, and trusted service-provider relationships to pivot into downstream victims. In some cases, the actor moved from an initially compromised provider through a second-hop provider before reaching the intended target. Separate intrusion chains abused SysAid software deployment and update functionality to deliver malicious components through DLL sideloading. Cavern Manticore operates a modular .NET-based post-exploitation framework centered on a persistent Cavern agent and interchangeable Cavern modules. The framework supports reconnaissance, file operations, database access, Active Directory and LDAP reconnaissance, network discovery, port scanning, SMB and LDAP brute-force activity, SOCKS5 proxying, WebSocket tunneling, lateral movement, and data theft. Its design separates communications from mission-specific modules, enabling tailored deployments and reduced forensic visibility. Anti-analysis and anti-forensics measures include mixed compilation formats across components, per-module AppDomain isolation, startup cleanup, self-update logic, and low-footprint modular loading. The actor has also been linked to HollowGraph, a .NET espionage implant associated with the Cavern ecosystem. HollowGraph uses compromised Microsoft 365 resources and the Microsoft Graph API for covert bidirectional command-and-control and exfiltration, with persistence tied to OAuth application registration. This activity was assessed as targeted espionage against Israeli organizations. Public corroboration for the precise organizational mapping of Cavern Manticore remains limited, so the MOIS linkage should be treated as moderate-confidence rather than definitive.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Iranian hacking crew referenced in connection with the Cavern/Cav3rn framework and the HOLLOWGRAPH malware, which abuses Microsoft Graph API and a compromised Microsoft 365 calendar as a covert two-way command-and-control channel.
Iran-nexus threat actor likely linked to the HollowGraph malware and a broader toolkit/framework.
Associated by Check Point with the Cavern framework/operator nexus tied to the HollowGraph espionage intrusion; discussed as an Iran-linked operator potentially connected to this activity.
Associated with the Cavern backdoor framework and linked with high confidence to the HOLLOWGRAPH espionage activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.