Iran-linked hackers associated with MOIS hackers are using a new modular C2 framework called Cavern (Cav3rn) against Israeli IT and government targets. The group tracked as Cavern Manticore, overlaps with MuddyWater and related Iranian APTs. Cavern is a .NET-based malware framework designed for stealth, using multiple compilation methods to make analysis difficult. It separates core communication from modules used for file access, network scanning, and system reconnaissance. Attacks begin by compromising IT tools like SysAid, then using DLL side-loading to deploy the malware and connect to a C2 server for additional payloads. The operation relies on supply-chain abuse and trusted IT providers to move laterally and exfiltrate data.