Cavern Manticore — Iran-Linked Cavern (Cav3rn) Modular C2 via SysAid / WinDirStat DLL Side-Loading

Cavern Manticore is a threat cluster tracked by Check Point Research and affiliated with Iran's Ministry of Intelligence and Security (MOIS). It shares tactical overlaps with MuddyWater and Lyceum and is focused on Israeli government and IT-services organizations — IT providers being a deliberate choice, since their trusted access into downstream customers makes them a stepping stone to harder targets.

The actor operates a previously undocumented, modular command-and-control framework called Cavern (aka Cav3rn). The intrusion begins by abusing SysAid's software-update feature to kick off a DLL side-loading chain: a legitimate signed WinDirStat.exe is dropped (observed at C:\ProgramData\WinDir\WinDirStat.exe) alongside a trojanized uxtheme.dll — the Cavern Agent. The Agent is built on a shared .NET foundation but deliberately mixes compilation formats (.NET Framework, Mixed-Mode C++/CLI, and .NET Native AOT) to force reverse engineers across multiple toolchains, and isolates each module in its own AppDomain as an anti-forensics measure.

The Agent's module dispatcher treats components whose names start with n- as native DLLs loaded via LoadLibraryA, and the rest as managed .NET assemblies. Modules include n-HTCommp.dll (HTTPS/WebSocket comms), mhm.dll (file manager), db.dll (SQL enumeration/export), ode.dll (Active Directory recon + LDAP brute-force), n-ten.dll (network recon, port & SMB brute-force), and n-sws.dll (SOCKS5 proxy + WebSocket tunnel). An older variant used a CAV3RN_Http_Module with a webshell (cac.aspx) hosted on a separate IIS server.

Defender priority: The highest-value, lowest-FP angles are WinDirStat.exe running from C:\ProgramData\WinDir\, a trojanized uxtheme.dll written outside the Windows system directories, the distinctive Cavern module DLLs (n-HTCommp / n-ten / n-sws / mhm / db / ode), the Check Point-published SHA-256 hashes, and DNS to the Cavern C2 domains (hospitalinstallation[.]com and its subdomains, adserviceupdate[.]com, hygienehistory[.]com). Patch/monitor SysAid and constrain DLL search order to break the side-load primitive.

Every atomic IOC below (SHA-256 hashes, C2 domains, module DLL filenames, host artifacts, deployment path, webshell name) traces to the Check Point Research indicator set. The SHA-256 hashes, C2 domains, and module DLL names are durable indicators; the deployment path C:\ProgramData\WinDir\ and mutex strings are strong but may vary between intrusions — hunt on the behaviour (WinDirStat side-loading uxtheme.dll) as the primary, atomic values as confirmation.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): WinDirStat.exe executed from C:\ProgramData\WinDir\ (or any user-writable path) — the Cavern side-load host in the wrong place. Covers T1574.002.
2. H2 (high): A trojanized uxtheme.dll was written outside the Windows system directories — the Cavern Agent staged for side-load. Covers T1574.002.
3. H3 (high): A distinctive Cavern module DLL (n-HTCommp / n-ten / n-sws / mhm / db / ode) was written to a staging path. Module drop.
4. H4 (high): A file matching a Check Point-published Cavern SHA-256 executed or was written. Atomic.
5. H5 (high): A host resolved a Cavern C2 domain (hospitalinstallation[.]com and subdomains, adserviceupdate[.]com, hygienehistory[.]com). Covers T1071.001.
6. H6 (high): WinDirStat.exe spawned a shell or recon utility (cmd/powershell/rundll32/net/nltest/whoami) — the sideloaded Agent running commands. Covers module recon.
7. H7 (medium): Cavern host artifacts appeared — steganographic .CvnC/.CvnA/.CvnR.png, config.txt, or inpt\/outpt\ working dirs. On-host tells.
8. H8 (medium): A cac.aspx webshell was written to a web-server path, or w3wp.exe spawned a shell. Covers older CAV3RN_Http_Module / T1505.003.
9. H9 (medium): The side-load host made SOCKS5 / WebSocket-style outbound connections (n-sws tunnel). Covers T1090 / T1571.

Attack chain

All values published by Check Point Research. SHA-256 hashes, C2 domains and module DLL names are durable; the deployment path and mutex strings are strong but may vary. uxtheme.dll is a legitimate Windows binary name — hunt on it only when it appears outside the system directories or is loaded by WinDirStat.exe from a staging path.

• SysAid server review: On any SysAid on-prem host, review the update/patch feature's activity and outbound history around the intrusion window, and confirm the server is fully patched. Cavern Manticore's initial access rides the SysAid software-update feature.
• Mutex sweep (RTR): On suspect hosts, enumerate named kernel objects for MYMUTEX123HELLP, MYMUTEX123HELLP02, and MYMUTEX123HELLP04 — the Cavern Agent's single-instance mutexes (not reliably in EDR telemetry, so check live).
• File-system sweep: Look for a C:\ProgramData\WinDir\ directory, an out-of-place uxtheme.dll, config.txt, inpt\/outpt\ working dirs, and stego files named .CvnC.png / .CvnA.png / .CvnR.png.
• Active Directory audit: Hunt for LDAP brute-force / heavy enumeration bursts (Event ID 4771/4625 spikes and abnormal LDAP query volume from a single workstation) consistent with ode.dll.
• IIS log review: On internet-facing IIS, search web logs and content for cac.aspx and for w3wp.exe spawning cmd.exe/powershell.exe — the older CAV3RN_Http_Module foothold.

Promotion path: validate the high-CONF/low-FP queries (Q1, Q2, Q5, Q6) against 7–14 days of baseline, confirm zero benign hits, then promote to Custom IOAs in detect mode; escalate Q1/Q6 to block once clean. Q4 hashes and Q5 domains → Custom IOC Management (block).

One-click blocks for SOC tooling. Hashes and domains are Check Point-published; swap expirations to fit your policy. Note WinDirStat.exe and uxtheme.dll are legitimate signed binaries — hunt on location/behaviour, do not blanket-block by name.

type,value,action,severity,expiration,description,tags
sha256,37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d4066,prevent,critical,2026-12-31,Cavern Agent uxtheme.dll b02,actor:CavernManticore;tool:Cavern
sha256,92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603b,prevent,critical,2026-12-31,Cavern Agent uxtheme.dll b04,actor:CavernManticore;tool:Cavern
sha256,5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b18,prevent,critical,2026-12-31,Cavern Agent uxtheme.dll old,actor:CavernManticore;tool:Cavern
sha256,a4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf41,prevent,critical,2026-12-31,n-HTCommp.dll comms,actor:CavernManticore;tool:Cavern
sha256,b630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e86,prevent,critical,2026-12-31,n-HTCommp.dll comms,actor:CavernManticore;tool:Cavern
sha256,8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a6134,prevent,critical,2026-12-31,mhm.dll file manager,actor:CavernManticore;tool:Cavern
sha256,0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc8,prevent,critical,2026-12-31,mhm.dll file manager old,actor:CavernManticore;tool:Cavern
sha256,5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b42,prevent,critical,2026-12-31,db.dll SQL browser,actor:CavernManticore;tool:Cavern
sha256,30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a10,prevent,critical,2026-12-31,ode.dll LDAP AD,actor:CavernManticore;tool:Cavern
sha256,2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b0,prevent,critical,2026-12-31,n-ten.dll network recon,actor:CavernManticore;tool:Cavern
sha256,7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255a,prevent,critical,2026-12-31,n-sws.dll SOCKS5 tunnel,actor:CavernManticore;tool:Cavern
sha256,541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819cb,prevent,critical,2026-12-31,Cav3rn agent old,actor:CavernManticore;tool:Cavern
sha256,cbc9485db715e1b8cc384fe94b4bceadca4006cda8a5e28adc8848529cfafc93,prevent,critical,2026-12-31,Cav3rn agent old,actor:CavernManticore;tool:Cavern
sha256,ccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e34748,prevent,critical,2026-12-31,Cav3rn HTTP module old,actor:CavernManticore;tool:Cavern
domain,hospitalinstallation.com,block,critical,2026-12-31,Cavern C2 parent,actor:CavernManticore;tool:Cavern
domain,adserviceupdate.com,block,critical,2026-12-31,Cavern C2 old,actor:CavernManticore;tool:Cavern
domain,hygienehistory.com,block,critical,2026-12-31,Cavern C2 old / cac.aspx host,actor:CavernManticore;tool:Cavern

[ Cavern Manticore / Cav3rn behaviors ]
- WinDirStat.exe running from C:\ProgramData\WinDir\ (or Users/Temp)
- uxtheme.dll written/loaded outside System32/SysWOW64/WinSxS
- Module DLLs: n-HTCommp / n-ten / n-sws / mhm / db / ode (.dll)
- WinDirStat.exe as parent of cmd/powershell/net/nltest/whoami
- DNS to hospitalinstallation[.]com (+ auth./google.com. subs),
  adserviceupdate[.]com, hygienehistory[.]com
- Outbound network connections owned by WinDirStat.exe (n-sws tunnel)
- Stego files .CvnC.png / .CvnA.png / .CvnR.png; config.txt; inpt\ outpt\
- Mutexes MYMUTEX123HELLP / ...02 / ...04
- cac.aspx webshell; w3wp.exe spawning cmd/powershell (older variant)

Actor:     Cavern Manticore (Iran / MOIS-affiliated espionage)
           Overlaps: MuddyWater, Lyceum
Framework: Cavern (aka Cav3rn) - modular .NET C2
Agent:     trojanized uxtheme.dll (side-loaded by WinDirStat.exe)
Compile:   .NET Framework + Mixed-Mode C++/CLI + .NET Native AOT
           per-module AppDomain isolation (anti-forensics)
Modules:   n-HTCommp (comms), mhm (files), db (SQL),
           ode (AD/LDAP), n-ten (net recon), n-sws (SOCKS5/tunnel)
Access:    SysAid software-update feature abuse
Older:     CAV3RN_Http_Module -> cac.aspx webshell (IIS)
Targets:   Israeli government & IT-services organizations

[ ] SysAid on-prem fully patched; update feature monitored
[ ] WDAC/AppLocker deny EXEs under C:\ProgramData, \Users\Public, \Windows\Temp
[ ] Block/alert DNS to hospitalinstallation / adserviceupdate / hygienehistory .com
[ ] Enable CFG / Safe DLL search order; audit side-loading of uxtheme.dll
[ ] IIS content roots reviewed for cac.aspx; w3wp child-spawn alerting on
[ ] AD: LDAP query/logon-failure baselining for ode.dll brute-force
[ ] RTR sweep for MYMUTEX123HELLP mutexes + C:\ProgramData\WinDir\
[ ] Egress filtering: block/inspect non-browser processes making WebSocket/SOCKS

• Telemetry ready: Confirm ProcessRollup2, PeFileWritten, FileCreateInfo, DnsRequest, and NetworkConnectIP4 are flowing from in-scope Windows endpoints and servers (including any SysAid and IIS hosts).
• Benign baseline: Run Q2 and Q3 (DLL writes) over 7–14 days; record any vendor installer that legitimately ships a private uxtheme.dll or a generically-named db.dll/mhm.dll, and exclude those paths before alerting.
• Positive test: In a lab, copy WinDirStat.exe to C:\ProgramData\WinDir\ and launch it, then have it spawn cmd.exe; confirm Q1 and Q6 fire. Write a dummy uxtheme.dll to C:\ProgramData\WinDir\ and confirm Q2 fires. Add a sinkholed DNS entry for one C2 domain and confirm Q5 fires.
• Promotion: Only promote Q1/Q2/Q5/Q6 to detect/block after zero benign hits across the baseline window.

P1 · Sweep for the Cavern side-load staging (WinDir + out-of-place uxtheme.dll)

$hits = @()
$dirs = 'C:\ProgramData\WinDir','C:\Users\Public','C:\Windows\Temp'
foreach ($d in $dirs) {
  if (Test-Path $d) {
    $hits += Get-ChildItem -Path $d -Recurse -Include 'WinDirStat.exe','uxtheme.dll',
      'n-HTCommp.dll','n-ten.dll','n-sws.dll','mhm.dll','db.dll','ode.dll','config.txt' `
      -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime
  }
}
# Any uxtheme.dll NOT under System32/SysWOW64/WinSxS is suspect:
$hits += Get-ChildItem 'C:\' -Recurse -Filter 'uxtheme.dll' -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -notmatch '\\Windows\\(System32|SysWOW64|WinSxS)\\' } |
  Select-Object FullName, Length, LastWriteTime
$hits

P2 · Enforce Safe DLL search order + deny-by-path execution (WDAC/AppLocker prep)

# Safe DLL search mode (reduces side-load surface)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' `
  -Name 'SafeDllSearchMode' -Type DWord -Value 1
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' `
  -Name 'CWDIllegalInDllSearch' -Type DWord -Value 0xFFFFFFFF
# Then author an AppLocker/WDAC deny rule for %ProgramData%, %Public%, %Windir%\Temp EXEs.
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name SafeDllSearchMode

P3 · Hunt IIS content roots for the cac.aspx webshell

$roots = Get-ChildItem 'C:\inetpub\wwwroot' -Directory -ErrorAction SilentlyContinue
Get-ChildItem 'C:\inetpub\wwwroot' -Recurse -Filter 'cac.aspx' -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime, @{n='SHA256';e={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}}

P4 · Block the Cavern C2 domains via local DNS sinkhole (stopgap)

$hostsFile = "$env:WINDIR\System32\drivers\etc\hosts"
$block = 'hospitalinstallation.com','adserviceupdate.com','hygienehistory.com'
foreach ($d in $block) {
  if (-not (Select-String -Path $hostsFile -Pattern ([regex]::Escape($d)) -Quiet)) {
    Add-Content -Path $hostsFile -Value "0.0.0.0 $d"
    Add-Content -Path $hostsFile -Value "0.0.0.0 www.$d"
  }
}
# Prefer an enterprise DNS/proxy block; the hosts file is a per-host stopgap only.

Detection is strongest at the side-load primitive (WinDirStat from a staging path, out-of-place uxtheme.dll), the atomic hashes, the C2 domains, and the sideloaded-host-spawns-recon behaviour — all low-FP. Module-DLL and stego hunts need environment tuning. The deepest recon (LDAP/SQL enumeration inside the module code) is a partial gap best closed with directory/database audit logging (§7).