A threat group linked to Iran’s Ministry of Intelligence and Security (MOIS) has been identified using a previously undocumented modular command-and-control (C2) framework known as Cavern (also called Cav3rn) in cyber espionage operations targeting Israeli organizations.
The campaign has primarily focused on IT service providers and government entities, with researchers noting tactical similarities to well-known Iranian threat groups including MuddyWater, Lyceum, and OilRig.
Cavern Uses a Sophisticated Modular Architecture
The Cavern framework is built on a flexible .NET architecture designed to support a wide range of post-compromise activities.
Researchers found that the malware combines multiple .NET compilation formats, including:
- .NET Framework
- Mixed-Mode C++/CLI
- .NET Native Ahead-of-Time (AOT)
This combination significantly complicates malware analysis by forcing security researchers to use multiple reverse engineering techniques and reconstruction methods.
Designed for Stealth and Flexibility
The framework separates its functionality into two primary components:
- Cavern Agent, responsible for communication with command-and-control servers.
- Cavern Modules, which provide mission-specific capabilities.
This modular design enables attackers to customize deployments based on the target environment while reducing forensic evidence. Individual modules handle reconnaissance, credential theft, lateral movement, network tunneling, and data exfiltration.
Attack Chain Begins Through Software Updates
The observed attacks begin by abusing SysAid’s software update mechanism.
Attackers leverage a DLL side-loading technique that loads a malicious uxtheme.dll file containing the Cavern Agent.
Once executed, the agent loads an additional communication module named n-HTCommp.dll, which connects to a remote command-and-control server over HTTPS or WebSocket to download additional malware modules as needed.
Five Specialized Modules Identified
Researchers identified five primary modules used by the framework:
- mhm.dll – File management, recursive searches, archiving, and file transfers.
- db.dll – SQL database discovery, querying, exporting, and manipulation.
- ode.dll – Active Directory reconnaissance, LDAP enumeration, and brute-force attempts.
- n-ten.dll – Network reconnaissance, port scanning, SMB enumeration, and brute-force activity.
- n-sws.dll – SOCKS5 proxy functionality and WebSocket tunneling.
The modular design allows operators to deploy only the components required for each individual operation.
Multiple .NET Compilation Methods Complicate Analysis
One of Cavern’s most distinctive features is its use of different compilation methods across its components.
Some modules are compiled using the traditional .NET Framework, while others rely on Native AOT compilation for improved performance and reduced metadata.
Meanwhile, the primary uxtheme.dll combines managed .NET code with native C++ within a single executable.
The framework also includes a dispatcher that automatically loads native DLLs using the Windows LoadLibraryA API while isolating managed .NET modules through AppDomain execution, making forensic analysis significantly more difficult.
Supply Chain Relationships Used for Lateral Movement
Researchers observed attackers exploiting trusted relationships between managed service providers and their customers.
In several incidents, the attackers first compromised one IT provider before moving to a second provider and eventually reaching the intended target organization.
By abusing legitimate Remote Monitoring and Management (RMM) tools and software update mechanisms, the attackers were able to distribute malware disguised as legitimate software updates.
The threat actors also leveraged browser-based remote desktop technologies and, in some cases, abused remote printing features to exfiltrate sensitive data when traditional clipboard or file transfer methods were unavailable.
Broader Iranian Cyber Espionage Activity
The discovery of the Cavern framework comes amid increased cyber activity attributed to Iranian state-sponsored groups.
In recent months, the MuddyWater threat group has conducted widespread reconnaissance across more than 12,000 internet-facing systems by exploiting known vulnerabilities in multiple enterprise platforms, including:
- SmarterMail (CVE-2025-52691)
- n8n (CVE-2025-68613)
- N-central (CVE-2025-9316)
- Langflow (CVE-2025-34291)
- Laravel Livewire (CVE-2025-54068)
Researchers reported that these campaigns progressed from broad vulnerability scanning to targeted credential theft and data exfiltration against organizations in the aviation, energy, and government sectors across the Middle East, including Egypt, Israel, and the United Arab Emirates.
The attacks combined vulnerability exploitation, Outlook Web Access (OWA) brute-force attacks, and multi-protocol command-and-control infrastructure to compromise targeted environments and steal sensitive information.
Final Thoughts
The Cavern framework demonstrates the growing sophistication of Iranian cyber espionage operations. Its modular architecture, advanced anti-analysis techniques, and ability to abuse trusted software supply chains make it a powerful tool for long-term network compromise.
Organizations that rely on managed service providers, Remote Monitoring and Management platforms, or enterprise software update systems should strengthen monitoring, apply security patches promptly, and closely watch for unusual activity that could indicate supply chain compromise.
