← threat actors
threat actor · not yet in the cluster map
cavern
also tracked as iranian nexus 1, cavern manticore 1
3 stories · 2 in the wild · July 7, 2026 – August 17, 2026
evidence: 2 observed · 1 demonstrated
sectors
- technology 2 · Jul 21
- government 1 · Jul 7
geography
- iran 2 · Aug 17
- israel 2 · Jul 21
malware and tools
- cavern 1 · Aug 17
- hollowgraph 1 · Jul 21
- cavern c2 1 · Jul 7
techniques
- command and control 2 · Aug 17
attack phases seen
- Command and control 3 · Aug 17
- Exfiltration 1 · Jul 21
what we reported, newest first, grouped by story
Aug 12 – August 17, 2026
- Cavern (Cav3rn) C2 evolves with DNS and Google Apps Script. Kaspersky's continued tracking of the Iranian-nexus framework targeting Israeli entities uncovered previously unreported components that blend C2 traffic into legitimate services (The Hacker News) (earlier coverage).
· Aug 17 · observed · as iranian nexus · Threat Intelligence
July 21, 2026
- HOLLOWGRAPH turns compromised Microsoft 365 mailboxes into a command-and-control channel, using the Microsoft Graph API to pull operator tasks and exfiltrate stolen files as attachments on calendar events dated to the year 2050 — blending malicious traffic into legitimate M365 flows. Group-IB attributes the .NET NativeAOT DLL to the Cavern backdoor framework and a suspected Israel-linked actor; the two-command implant (
get/send) exploits no vulnerabilities, relying entirely on trusted cloud infrastructure to evade network detection. Group-IB (via NCSC-FI), The Hacker News.
· Jul 21 · demonstrated · Threat Activity & Tradecraft
July 7, 2026
- Cavern (aka Cav3rn / Cavern Manticore), a previously undocumented modular C2 framework tied to Iran's MOIS, is being used against Israeli IT providers and government entities. Check Point documents custom C2 protocols, anti-analysis features, and low detection rates (The Hacker News, Check Point).
· Jul 7 · observed · as cavern manticore · Threat Activity