Cavern: The .NET Framework That Challenges Analysts With Three…

Check Point Research has unveiled Cavern, a modular .NET C2 framework used by the Iranian threat actor Cavern Manticore. The framework's primary anti-analysis weapon is its deliberate architectural choice to compile modules in three distinct binary formats, forcing analysts to switch toolchains for each component.

On July 6, 2026, Check Point Research published a technical analysis of "Cavern," a modular command-and-control framework built entirely on .NET and employed by the threat actor "Cavern Manticore" against Israeli targets in the government and IT sectors. The framework's distinguishing feature is not traditional obfuscation, but a deliberate architectural choice: modules are compiled in three distinct binary formats, forcing anyone analyzing a sample to switch tools and methodologies for every component.

Key Takeaways

Cavern Manticore is an Iran-MOIS-linked actor with documented technical overlaps with MuddyWater and Lyceum, the latter identified by ESET as a subgroup of OilRig (APT34) with an exclusively Israeli focus.
The "Cavern" framework adopts three .NET compilation formats as its primary anti-analysis layer: IL-only, Mixed-Mode C++/CLI, and NativeAOT, each requiring a dedicated reverse-engineering toolchain.
The execution chain begins with abuse of the SysAid software update feature, proceeds through DLL sideloading via the legitimate WinDirStat.exe, and a trojanized uxtheme.dll with 82 stub functions and a single functional one.
Specialized modules cover post-exploitation across file systems, SQL databases, LDAP, networking, and SOCKS5/WebSocket tunneling, with AppDomain isolation as an anti-forensics measure.

.NET as an Attack Platform, Not Just an Enterprise One

The choice of .NET as the framework's foundation is not accidental. According to Check Point Research, the same platform that simplifies enterprise development is exploited to build malware that evades traditional detection. Most analyzed samples achieve zero or very low detection rates on VirusTotal. The mechanism does not rely on conventional obfuscation techniques, but on binary format diversification: IL-only (trivially decompilable), Mixed-Mode C++/CLI (requiring analysis of both managed and native code), and NativeAOT (ahead-of-time compilation producing native binaries without .NET metadata).

This tripartite division forces the analyst to operate with different toolchains for each module. In the case of Mixed-Mode C++/CLI, as CPR observes, "the analyst has to reverse the same binary twice in two different toolchains." NativeAOT represents the toughest case: 60% of functions are matched via FLIRT signatures, but the remaining 40% requires extensive manual analysis. NativeAOT modules resolve sensitive APIs via P/Invoke managed by runtime descriptor tables, hiding imports from the table visible in static analysis.

How the Execution Chain Works

Infection begins with abuse of the SysAid software update function. From there, the legitimate executable WinDirStat.exe loads a compromised uxtheme.dll, a classic DLL sideloading scheme. The malicious DLL exports 83 functions mimicking the Windows theming library: 82 are empty stubs; the actual function is EnableThemeDialogTexture (ordinal #20), which triggers the backdoor payload.

The "Cavern Agent" module (uxtheme.dll, Mixed-Mode C++/CLI format) connects to the communication module "n-HTCommp.dll" (NativeAOT). From this point, the operator can dynamically load specialized modules: "mhm.dll" for the file system, "db.dll" for SQL database interaction, "ode.dll" for LDAP queries, "n-ten.dll" for network operations, and "n-sws.dll" for tunneling via SOCKS5 and WebSocket. The framework shares 61 command IDs in the Command.Type enum across IL-only modules, ensuring interoperability.

The Actor Context: From OilRig to Cavern Manticore

Check Point Research explicitly links Cavern Manticore to the Iranian MOIS (Ministry of Intelligence and Security) and documents technical overlaps with MuddyWater and Lyceum. In a June 5, 2025 update, ESET redefined Lyceum as a subgroup of OilRig (APT34), specifying that activities described in previous reports fall under this label. ESET's reconstruction documents Lyceum's historical .NET backdoors — Solar, Mango, DanBot, Shark, Milan — with exclusively Israeli targeting. The brief does not specify whether Cavern Manticore is formally a further subgroup of OilRig or a distinct actor with which Lyceum shares tooling.

Convergence between sources lies in the geographic and sectoral targeting (Israel, government and IT) and the systematic adoption of .NET for the entire arsenal. The source does not specify whether the Cavern framework is used exclusively by Cavern Manticore or shared with other MOIS subgroups. No infrastructure overlaps emerge linking the actor to campaigns documented prior to 2026.

"the compilation format itself becomes the anti-analysis layer" — Check Point Research

Immediate Actions

For Israeli organizations in the government and IT sectors, the first step is to verify the presence of WinDirStat.exe in environments where it is not expected: the uxtheme.dll sideloading depends on the coexistence of this executable with the trojanized DLL. Security teams must check uxtheme.dll file signatures in third-party application directories, not only in System32 where the legitimate version resides.

Threat analysts must update toolchains to include support for NativeAOT and Mixed-Mode C++/CLI: the 60% FLIRT signature match rate on NativeAOT means the remaining 40% requires manual analysis with tools like Ghidra or IDA Pro configured for pure native code. Automated analysis platforms relying solely on standard .NET decompilers (dnSpy, ILSpy) will fail on two of the three formats used by Cavern.

For managed security providers, the priority is mapping the use of SysAid as a software update vector: the brief documents abuse of this specific feature, not a product vulnerability. Controls must focus on update processes that load executables outside the expected installation path.

Open Questions

How widespread is the framework outside Israeli targets?

The brief does not document campaigns using Cavern against targets in other regions. Geographic targeting remains confined to Israel in the verified facts available.

Are NativeAOT modules actually "more invisible" or just more laborious to analyze?

According to CPR, most samples achieve zero or very low detection on VirusTotal. The low detection correlates with analytical complexity, not necessarily with greater runtime sophistication: precompiled native code evades standard .NET heuristics.

Is there a specific defense against WinDirStat sideloading?

The dossier does not mention specific countermeasures or patches for the abused legitimate executable. The absence of assigned CVEs in the brief suggests the vulnerability lies in the DLL loading configuration rather than a defect in the software itself.

The Cavern framework demonstrates that modularity concerns not only malware functionality, but also the distribution of analytical complexity: every module is a separate problem for investigators. Actors with the resources to design the build process as an anti-forensics weapon raise the cost of defense not with new zero-days, but with the inertia of existing tools.

Information is based on the cited source and current as of publication.

Sources

Sources and references