Cavern Manticore Exploits SysAid RMM and WinDirStat DLL Sideloading for C2 Deployment

Key Takeaways

• A new Iranian-backed threat group, Cavern Manticore, is actively targeting Israeli organizations, including government entities and IT service providers.
• The group leverages legitimate IT tools like SysAid Remote Monitoring and Management (RMM) and WinDirStat to deploy its modular malware, “Cavern,” through DLL sideloading.
• Cavern is a sophisticated, multi-stage command-and-control (C2) framework designed for stealth, data exfiltration, and network reconnaissance, featuring anti-forensic capabilities.
• The campaign highlights a growing trend of attackers abusing trusted software and supply chain vectors to bypass traditional security defenses.

A newly identified Iranian-linked hacking collective, dubbed Cavern Manticore by researchers, has been observed in a campaign exploiting common IT administration tools to infiltrate Israeli networks. This sophisticated group demonstrates a preference for subtle tactics, leveraging trusted software to conceal its malicious activities rather than relying on overt exploits.

The core of Cavern Manticore’s strategy involves transforming legitimate software into a delivery mechanism for its espionage tools. This approach allows the attackers to operate under the radar, blending in with normal network traffic and operations.

Security researchers at Check Point unearthed the campaign during an investigation into suspicious activities originating from IT service providers in Israel. The group exhibited a calculated, multi-stage attack methodology, initially compromising an IT provider, then pivoting to a secondary organization before ultimately reaching its intended high-value target.

In a report shared with Cyber Security News (CSN), Check Point detailed the malware, named Cavern, as a highly modular command-and-control (C2) framework. This modular design enables the attackers to dynamically swap components based on their objectives, making the framework highly adaptable.

Cavern’s modules are engineered for diverse functions, ranging from fundamental communication protocols to advanced capabilities like file exfiltration, database querying, and network scanning. This architecture allows the threat group to customize each attack, deploying only the necessary tools without needing to re-engineer the entire payload.

A significant challenge in detecting and analyzing Cavern stems from its use of three distinct compilation methods for the same codebase. Each version requires a unique analytical toolset, deliberately slowing down defensive efforts to understand the malware’s full capabilities. This, coupled with observed links to other Iranian state-sponsored groups such as MuddyWater and Lyceum, points to a well-resourced and patient adversary.

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading

The infection chain initiated by Cavern Manticore exploits the software update functionality within SysAid, a widely used remote monitoring and management platform. Through this vector, the attackers deliver a package of files disguised as a legitimate update for WinDirStat, a disk usage statistics viewer.

When the authentic WinDirStat application is executed, it inadvertently loads a malicious version of uxtheme.dll, a standard Windows system file. This trojanized DLL is, in fact, the Cavern backdoor, injected through a technique known as DLL sideloading. You can find a detailed analysis of this execution chain in the Check Point report.

Once activated, the Cavern backdoor establishes encrypted communication with its C2 server, making its traffic difficult to detect. It then dynamically fetches additional modules as needed, granting the attackers capabilities such as file browsing, database querying, directory enumeration, and network tunneling for deeper penetration.

A key characteristic of Cavern’s design is its anti-forensic capabilities. Each module operates within an isolated environment and is purged from memory upon completion, hindering post-compromise analysis. Furthermore, the malware meticulously cleans its working directory, deleting most temporary files to obscure its presence and frustrate incident responders attempting to reconstruct the attack timeline.

Who Cavern Manticore Is Targeting

Cavern Manticore’s primary targets are Israeli organizations, with a particular focus on government entities and IT service providers. The strategic targeting of IT providers is deliberate, as these companies often possess privileged access to numerous client networks, serving as an ideal pivot point for reaching higher-value targets.

Forensic analysis has traced the group’s infrastructure to a domain registered through an Iranian hosting provider, bolstering the assessment of state-sponsored activity. The observed tactical overlaps with threat groups like MuddyWater and Lyceum, both known to be affiliated with Iran’s intelligence services, further reinforces this attribution. Detailed indicators of compromise (IoCs) are provided in the table below.

This campaign underscores the critical importance for organizations to scrutinize how their remote management tools are utilized. Attackers are increasingly opting to infiltrate through trusted administrative channels rather than attempting to breach obvious vulnerabilities. The methodical approach employed by Cavern Manticore, from exploiting supply chain trust to implementing custom evasion techniques, demands a patient and robust defensive posture from organizations.

What You Should Do

• Review RMM Logs: Regularly audit logs and activity associated with remote monitoring and management (RMM) software like SysAid for any unusual update deployments or executions.
• Monitor DLL Activity: Implement robust monitoring for suspicious file activity involving system DLLs, particularly uxtheme.dll, and pay close attention to unexpected DLL placements in application directories.
• Enhance Access Controls: Implement strict access controls and multi-factor authentication for RMM platforms. Limit remote session durations and enforce least privilege principles.
• Behavioral Detection: Focus on behavioral detection mechanisms rather than relying solely on static indicators of compromise, as Cavern’s polymorphic nature makes signature-based detection less effective. Look for unusual process behavior, network connections, and file system modifications.
• Network Segmentation: Segment networks to limit lateral movement in case of a compromise, especially between IT service provider networks and client environments.
• Threat Intelligence: Stay informed on the latest threat intelligence regarding Iranian state-sponsored groups and their evolving tactics, techniques, and procedures (TTPs).

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.