Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

A newly discovered cyberespionage campaign with ties to Iranian intelligence operations has been targeting Israeli organizations using an advanced command-and-control framework previously unseen in the wild. Security researchers have identified this threat actor as leveraging a modular C2 infrastructure they've dubbed Cavern, also known as Cav3rn, which demonstrates significant technical sophistication and raises concerns about the evolving capabilities of state-sponsored threat groups.

The attacks have primarily focused on Israeli IT providers and government entities, suggesting strategic targeting of organizations with access to sensitive data and systems that could be valuable for intelligence gathering purposes. What makes this campaign particularly notable is the connection to Iran's Ministry of Intelligence and Security (MOIS), indicating this is not merely opportunistic cybercrime but rather a coordinated effort with potential political motivations. The threat cluster was recently identified by researchers at Check Point, who have been tracking the group's activities and analyzing their operational tactics.

The emergence of the Cavern framework represents an evolution in Iranian cyber capabilities, as it appears to be a custom-built solution designed specifically for stealthy persistence within compromised networks. The modular nature of this C2 infrastructure allows threat actors to dynamically load various components and capabilities, potentially evading traditional security detection mechanisms that might flag more conventional malware families