Iranian MOIS Group Deploys Modular Cavern Framework Against Israeli IT Firms
Check Point uncovered a new modular C2 framework, Cavern (Cav3rn), used by an Iranian MOIS‑backed group to infiltrate Israeli IT providers. The .NET‑based tool employs multi‑format compilation and DLL side‑loading via SysAid updates, delivering bespoke modules for data theft, network scouting, and lateral movement.