Cavern modular malware that exploits supply chain to infiltrate governments and suppliers

A hacking group linked to the Iranian intelligence service has deployed a modular command and control infrastructure so far undocumented, baptized as Cavern(or Cav3rn), and has used it in campaigns directed mainly against Israeli organizations, especially IT service providers and government entities. According to public reports, the threat synthesizes advanced capacities for persistence and adaptation through a clear separation between a Central agent and specialized modules charged dynamically for specific tasks such as exfiltration, Active Directory recognition, database theft and tunelization.

Technically, one of the most relevant features of this operation is the deliberate use of several .NET compilation formats: from pure .NET Framework assemblies to Mixed-Mode C + + / CLI binaries and modules compiled with Native AOT. This approach not only fragments the forensic analysis surface - forcing analysts to alternate between different tools and metadata recovery flows - but also facilitates the combination of managed and native code in the same executable to hide useful loads and evade traditional detections.

The documented initial vector takes advantage of a legitimate software update functionality on the SysAid platform, implementing a chain of DLL side-rolling that culminates in the execution of a trotting DLL that acts as an agent. From there, the agent requests additional modules to the C2 server and loads, as appropriate, native dlls by LoadLibraryA or assembled .NET within isolated AppDomains, which complicates the reconstruction of evidence and reduces forensic visibility.

Beyond the technique, the operation demonstrates an operational strategy aimed at exploiting trust relations in the supply chain: the attackers first commit to an IT provider, pivote to a second supplier and from there reach the ultimate goal. The use of remote management tools (RMM) and remote desktop technologies in the browser allows aggressors to persist, move laterally and, when direct transfers are restricted, even abuse functions such as remote printing to exfilter data.

In parallel, campaigns attributed to other groups sponsored by the Iranian State have been scanning and exploiting remote-execution vulnerabilities in multiple widely used products, suggesting a comprehensive phase of recognition followed by targeted attacks for the extraction of credentials and theft of information in sectors such as aviation, energy and public administration. The exploited vulnerabilities are listed on public bases and should be verified on official sources to prioritize patches and mitigations.

The implications for managed organizations and suppliers are direct: the inherent trust between customer and supplier is a risk multiplier. An incident in a supplier with high privileges can become a massive access door to customer environments. In addition, the use of advanced anti-analysis techniques by malware increases the cost and complexity of research, and can delay detection and containment.

In order to reduce exposure and improve response capacity, organisations must strengthen technical and operational controls. It is critical to tighten the RMM ecosystem: limit privileges, apply strict network segmentation, require multifactor authentication for remote access and validate the integrity of the software update mechanisms they handle. Security teams should monitor specific signals such as unexpected DLL loads in third-party service processes, use of LoadLibraryA for modules with abnormal names and recurrent creation of AppDomains hosting unsigned assemblies.

The detection and response measures should be complemented by basic but effective practices: maintaining exposed software and up-to-date devices, auditing accounts with privileges and rotating credentials, activating detailed telemetry records in endpoints and proxys, and using EDR solutions with the capacity to detect side-rolling patterns, implementation of mixed native / managed code and outgoing suspicious connections to unintended domains. In the event of a commitment, follow a response plan that includes house isolation, chain-of-custody analysis of native and managed .NET devices, and coordination with suppliers and affected third parties.

Finally, those who manage public infrastructure or third-party services should integrate security controls into the software life cycle and contractual agreements: regular security audits, incident reporting clauses and performance-resilience tests. For technical monitoring and public references on related threats and vulnerabilities, resources from the sector can be consulted, such as Check Point Research and the NIST vulnerability database in NVD as well as Microsoft technical documentation on the behavior and risks associated with DLs and the loading of libraries in Windows on Microsoft Learn.