Iran‑linked Cavern Manticore Deploys Modular .NET C2 via SysAid Update Abuse
Check Point Research uncovered a new .NET‑based command‑and‑control framework used by the Iran‑MOIS‑backed group Cavern Manticore. The actors hijack SysAid’s legitimate software‑update feature to sideload a malicious DLL, then load additional native and managed modules for reconnaissance, data exfiltration, and lateral movement. The modular design lets operators tailor payloads per victim and hampers analysis.