{"id":14116,"date":"2026-07-07T10:03:39","date_gmt":"2026-07-07T10:03:39","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/07\/cavern-manticore-abuses-sysaid-rmm-and-windirstat-dll-sideloading-to-deploy-c2-framework\/"},"modified":"2026-07-07T10:03:39","modified_gmt":"2026-07-07T10:03:39","slug":"cavern-manticore-abuses-sysaid-rmm-and-windirstat-dll-sideloading-to-deploy-c2-framework","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/07\/cavern-manticore-abuses-sysaid-rmm-and-windirstat-dll-sideloading-to-deploy-c2-framework\/","title":{"rendered":"Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework"},"content":{"rendered":"

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new Iranian-linked hacking group has been caught abusing everyday IT tools to slip malware onto Israeli networks. <\/p>\n

Researchers have named the group Cavern Manticore, and its latest campaign shows how creative attackers have become at hiding in plain sight. <\/p>\n

Instead of flashy exploits, the group leans on software organizations already trust. <\/a>At the heart of this campaign is a technique that turns helpful software into a delivery mechanism for spying tools. <\/p>\n

The attackers abuse SysAid, a remote monitoring and management platform, to push out a fake software update. That update quietly drops a legitimate looking file that loads hidden malicious code, a method known as DLL sideloading.<\/a><\/p>\n

Check Point researchers identified the campaign after digging into unusual activity tied to IT service providers in Israel. The group did not stop at one company. It moved from a compromised IT provider to a second organization before reaching its real target.<\/a><\/p>\n

Check Point said in a report<\/a> shared with Cyber Security News (CSN) that the malware, called Cavern, is a modular framework, meaning its pieces can be swapped in and out depending on what the attackers want to do. <\/p>\n

Some parts handle basic communication, while others are built for stealing files, poking around databases, or scanning networks. This design lets the group tailor each attack without rebuilding everything.<\/a><\/p>\n

What makes Cavern tricky to catch is its use of three different ways of compiling the same code. Each version needs a different toolset to analyze, slowing down defenders trying to figure out what the malware does. <\/p>\n

Combined with links to Iranian groups like MuddyWater<\/a> and Lyceum, this points to a patient, well resourced adversary.<\/a><\/p>\n

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading<\/strong><\/h2>\n

The infection begins when Cavern Manticore abuses the software update feature inside SysAid to deliver a bundle of files tied to WinDirStat, a legitimate disk usage tool.<\/a><\/p>\n

When the real WinDirStat program runs, it unknowingly loads a fake version of a Windows file called uxtheme.dll, which is actually the Cavern backdoor in disguise. <\/p>\n

\n
\"Cavern
Cavern Agent Execution Chain (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n

Once active, this backdoor reaches out to a separate file that handles network traffic, encrypting communications so they are harder to spot. <\/p>\n

It then pulls down extra modules on demand, giving attackers tools to browse files, query databases, search directories, or tunnel deeper into the network.<\/a><\/p>\n

Each module runs in an isolated space and is removed from memory once finished, making it harder for investigators to find evidence later. The malware also cleans up after itself, deleting most files in its working folder except what it needs to keep running.<\/a><\/p>\n

This housekeeping is a deliberate anti-forensics step<\/a>, aimed at frustrating anyone trying to piece together what happened after the fact.<\/a><\/p>\n

Who Cavern Manticore Is Targeting<\/strong><\/h2>\n

Cavern Manticore appears focused on Israeli organizations, especially those in government and IT services. <\/p>\n

The interest in IT providers is not accidental, since these companies often have trusted access into other businesses, making them an ideal stepping stone toward harder targets. <\/p>\n

\n
\"Cavern
Cavern Modules Evade Malware Engines (Source \u2013 Check Point)<\/figcaption><\/figure>\n<\/div>\n

Investigators traced the infrastructure to a domain registered through an Iranian hosting provider, adding weight to the assessment that this is state linked activity. <\/p>\n

Overlaps with techniques used by MuddyWater and Lyceum, both tied to Iran\u2019s intelligence services, support that connection.<\/a><\/p>\n

The organizations should watch how their remote management tools are used, since attackers increasingly hide inside trusted administrative channels instead of breaking in through obvious weak points.<\/a><\/p>\n

Security teams are urged to review logs and file activity involving uxtheme.dll, since that file name is a known target for sideloading abuse. <\/p>\n

Limiting remote sessions, tightening access to RMM software<\/a>, and watching for unusual DLL placement can help catch this activity early.<\/a><\/p>\n

Because the malware behaves differently across builds, defenders are encouraged to focus on behavior patterns and infrastructure clues rather than fixed indicators.<\/a><\/p>\n

This case is a reminder that trusted software can become a weapon when attackers get creative. Cavern Manticore\u2019s methodical approach, from supply chain hopping to custom evasion tricks, shows patience organizations cannot ignore.<\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
SHA-256<\/td>\n37e123bd7998af4eae32718ce254776f36365a80ba56952593dab46f536d406<\/td>\nuxtheme.dll (build 02) \u2014 Cavern Agent<\/td>\n<\/tr>\n
SHA-256<\/td>\n92cae0ad7f98f51a14bcc0ee05e372ebdc29ea96ea7bd161bd3f55198767603<\/td>\nuxtheme.dll (build 04) \u2014 Cavern Agent<\/td>\n<\/tr>\n
SHA-256<\/td>\n5dc08bda6919a57a85e5f38b857985fa71529ca39c8299868d5a49a987e19b1<\/td>\nuxtheme.dll (oldest build) \u2014 Cavern Agent<\/td>\n<\/tr>\n
SHA-256<\/td>\na4aa217def4c38f4ecacdf47b1cd687f60cc74c18ab75195be3c4357a790bf4<\/td>\nn-HTCommp.dll \u2014 Communication module<\/td>\n<\/tr>\n
SHA-256<\/td>\nb630c96d3763182533d4fb9b614134382bd644cb02c6c1c3ade848b6ecc31e8<\/td>\nn-HTCommp.dll \u2014 Communication module<\/td>\n<\/tr>\n
SHA-256<\/td>\n8e9425c0b46eeb516610ae913d13f2b3f44a023043cb099277031d4ec38a613<\/td>\nmhm.dll \u2014 File manager module<\/td>\n<\/tr>\n
SHA-256<\/td>\n0a3663648a46771a5a5423ad01e91a4e7ba825595e99fa934cb35cbb4848adc<\/td>\nmhm.dll (older variant) \u2014 File manager module<\/td>\n<\/tr>\n
SHA-256<\/td>\n5394d3b220de4695f731647e3a70545f951a8912ceb0c6585efab8d6842e8b4<\/td>\ndb.dll \u2014 SQL browser module<\/td>\n<\/tr>\n
SHA-256<\/td>\n30cb4679c4b8599eeb3d63a551716475c6332bdc4d4b4e3de0964aadb3092a1<\/td>\node.dll \u2014 LDAP\/Directory module<\/td>\n<\/tr>\n
SHA-256<\/td>\n2cb1ad3b22db8e3666ea138fee88034a87a87cf43db3d3265a675ebf221379b<\/td>\nn-ten.dll \u2014 Network reconnaissance module<\/td>\n<\/tr>\n
SHA-256<\/td>\n7d586fb7f94182a8e2a0e53c7e4deb898066da029da5cd9972a94a59ca6d255<\/td>\nn-sws.dll \u2014 SOCKS5\/WebSocket tunnel module<\/td>\n<\/tr>\n
SHA-256<\/td>\n541b1f417b9e42078c3355693a8a492b6a76048850f6549a429e0be99e6819c<\/td>\nOlder Cav3rn-era, non-modular agent sample<\/td>\n<\/tr>\n
SHA-256<\/td>\nbcbc9485db715e1b8cc384fe94b4cceadca4006cda8a5e28adc8848529cfafc<\/td>\nOlder Cav3rn-era, non-modular agent sample<\/td>\n<\/tr>\n
SHA-256<\/td>\nbccf218189c3aadb1c761da14bfda3bae686769031e1e1b10007648bd72e347<\/td>\nOlder CAV3RNHttpModule sample<\/td>\n<\/tr>\n
Domain<\/td>\nhospitalinstallation.com<\/td>\nParent domain used for C2 infrastructure<\/td>\n<\/tr>\n
Domain<\/td>\nauth.hospitalinstallation.com<\/td>\nC2 domain used by older Cavern agent builds<\/td>\n<\/tr>\n
Domain<\/td>\ngoogle.com.hospitalinstallation.com<\/td>\nC2 domain used by newer Cavern agent builds<\/td>\n<\/tr>\n
Domain<\/td>\nadserviceupdate.com<\/td>\nC2 domain invoked by older Cav3rn HTTP module<\/td>\n<\/tr>\n
Domain<\/td>\nhygienehistory.com<\/td>\nC2 domain invoked by older Cav3rn HTTP module<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/adserviceupdate.com\/cac.aspx<\/td>\nOperator deployed ASP.NET C2 handler<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/hygienehistory.com\/cac.aspx<\/td>\nOperator deployed ASP.NET C2 handler<\/td>\n<\/tr>\n
File\/Artifact<\/td>\nuxtheme.dll<\/td>\nTrojanized DLL sideloaded via WinDirStat.exe<\/td>\n<\/tr>\n
File\/Artifact<\/td>\nn-HTCommp.dll<\/td>\nNative communication module used for C2 traffic<\/td>\n<\/tr>\n
File\/Artifact<\/td>\nconfig.txt<\/td>\nAgent configuration file (keys: i, xd, int)<\/td>\n<\/tr>\n
File\/Artifact<\/td>\nCvn.cfg \/ Cvn.cfg.A \/ Cvn.cfg.U<\/td>\nLegacy alive-time configuration files<\/td>\n<\/tr>\n
File\/Artifact<\/td>\n.CvnC.png \/ .CvnA.png \/ .CvnR.png<\/td>\nSteganographic command, API, and result files (older Cav3rn variant)<\/td>\n<\/tr>\n
File\/Artifact<\/td>\ncac.aspx<\/td>\nOperator-deployed ASP.NET handler path<\/td>\n<\/tr>\n
Directory<\/td>\ninpt \/ outpt<\/td>\nCommand and result drop directories used by older Cav3rn agent<\/td>\n<\/tr>\n
Mutex<\/td>\nMYMUTEX123HELLP, MYMUTEX123HELLP02, MYMUTEX123HELLP04<\/td>\nMutex names used across Cavern agent builds<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Prevent critical incidents and financial loss with stronger proactive defense. <\/strong>Integrate a live threat feed from 15K SOC Teams<\/a><\/strong>.<\/p>\n

\n

The post Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Cavern Manticore Abuses SysAid RMM and WinDirStat DLL Sideloading to Deploy C2 Framework A new Iranian-linked hacking group has been caught abusing everyday IT tools to slip malware onto Israeli networks. Researchers have named the group Cavern Manticore, and its latest campaign shows how creative attackers have become at hiding in plain sight. Instead of […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-14116","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14116"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=14116"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14116\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=14116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=14116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=14116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}