Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework

A new Iranian-linked hacking group has been caught abusing everyday IT tools to slip malware onto Israeli networks.

Researchers have named the group Cavern Manticore, and its latest campaign shows how creative attackers have become at hiding in plain sight.

Instead of flashy exploits, the group leans on software organizations already trust. At the heart of this campaign is a technique that turns helpful software into a delivery mechanism for spying tools.

The attackers abuse SysAid, a remote monitoring and management platform, to push out a fake software update. That update quietly drops a legitimate looking file that loads hidden malicious code, a method known as DLL sideloading.

Check Point researchers identified the campaign after digging into unusual activity tied to IT service providers in Israel. The group did not stop at one company. It moved from a compromised IT provider to a second organization before reaching its real target.

Check Point said in a report shared with Cyber Security News (CSN) that the malware, called Cavern, is a modular framework, meaning its pieces can be swapped in and out depending on what the attackers want to do.

Some parts handle basic communication, while others are built for stealing files, poking around databases, or scanning networks. This design lets the group tailor each attack without rebuilding everything.

What makes Cavern tricky to catch is its use of three different ways of compiling the same code. Each version needs a different toolset to analyze, slowing down defenders trying to figure out what the malware does.

Combined with links to Iranian groups like MuddyWater and Lyceum, this points to a patient, well resourced adversary.

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading

The infection begins when Cavern Manticore abuses the software update feature inside SysAid to deliver a bundle of files tied to WinDirStat, a legitimate disk usage tool.

When the real WinDirStat program runs, it unknowingly loads a fake version of a Windows file called uxtheme.dll, which is actually the Cavern backdoor in disguise.

Once active, this backdoor reaches out to a separate file that handles network traffic, encrypting communications so they are harder to spot.

It then pulls down extra modules on demand, giving attackers tools to browse files, query databases, search directories, or tunnel deeper into the network.

Each module runs in an isolated space and is removed from memory once finished, making it harder for investigators to find evidence later. The malware also cleans up after itself, deleting most files in its working folder except what it needs to keep running.

This housekeeping is a deliberate anti-forensics step, aimed at frustrating anyone trying to piece together what happened after the fact.

Who Cavern Manticore Is Targeting

Cavern Manticore appears focused on Israeli organizations, especially those in government and IT services.

The interest in IT providers is not accidental, since these companies often have trusted access into other businesses, making them an ideal stepping stone toward harder targets.

Investigators traced the infrastructure to a domain registered through an Iranian hosting provider, adding weight to the assessment that this is state linked activity.

Overlaps with techniques used by MuddyWater and Lyceum, both tied to Iran’s intelligence services, support that connection.

The organizations should watch how their remote management tools are used, since attackers increasingly hide inside trusted administrative channels instead of breaking in through obvious weak points.

Security teams are urged to review logs and file activity involving uxtheme.dll, since that file name is a known target for sideloading abuse.

Limiting remote sessions, tightening access to RMM software, and watching for unusual DLL placement can help catch this activity early.

Because the malware behaves differently across builds, defenders are encouraged to focus on behavior patterns and infrastructure clues rather than fixed indicators.

This case is a reminder that trusted software can become a weapon when attackers get creative. Cavern Manticore’s methodical approach, from supply chain hopping to custom evasion tricks, shows patience organizations cannot ignore.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.