{"id":286357,"date":"2026-07-06T12:00:00","date_gmt":"2026-07-06T16:00:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/07\/06\/new-iran-nexus-hacking-group-targets-israel-government-and-it-sectors\/"},"modified":"2026-07-06T12:15:19","modified_gmt":"2026-07-06T16:15:19","slug":"new-iran-nexus-hacking-group-targets-israel-government-and-it-sectors","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/07\/06\/new-iran-nexus-hacking-group-targets-israel-government-and-it-sectors\/","title":{"rendered":"New Iran-Nexus Hacking Group Targets Israel Government and IT Sectors"},"content":{"rendered":"

New Iran-Nexus Hacking Group Targets Israel Government and IT Sectors<\/a><\/p>\n

https:\/\/www.infosecurity-magazine.com\/news\/new-iran-hacking-group-targets\/<\/a><\/p>\n

Publish Date: 2026-07-06 12:00:00<\/a><\/p>\n

Source Domain: www.infosecurity-magazine.com<\/a><\/p>\n

A new cyber threat group linked to the Iranian government has been targeting Israeli government and IT organizations since early 2026, according to Check Point Research.<\/p>\n

The group, tracked by the Tel Aviv-headquartered cybersecurity firm as \u2018Cavern Manticore,\u2019 shares technical overlaps with MuddyWater\u00a0and\u00a0Lyceum, two threat groups with attributed links to Iran\u2019s Ministry of Intelligence and Security (MOIS).<\/p>\n

Check Point researchers also observed the group deploying a previously undocumented modular command-and-control (C2) infrastructure.<\/p>\n

\u201cThe adversary\u2019s ability to gain access to organizations in the defense and government sectors during the US military campaign \u2018Operation Epic Fury\u2019 demonstrates both a high operational tempo and a disciplined approach to target selection,\u201d the researchers wrote in a threat intelligence report published on July 6.<\/p>\n

Cavern Manticore\u2019s Modular C2 Infrastructure<\/strong><\/h2>\n

According to Check Point, Cavern Manticore typically gains access to its targets\u2019 IT environments by abusing existing remote monitoring and management (RMM) software.<\/p>\n

By exploiting these tools, the actor can move laterally between victims and deliver malicious software disguised as legitimate updates.<\/p>\n

Another common initial access vector involves abusing browser-based remote desktop tools, such as remote printing, to exfiltrate data when clipboard-based copy-paste or file-transfer capabilities are restricted.<\/p>\n

Once it has established initial access, the threat actor enables a SysAid\u2019s software update which leads to installing malicious assets on the targeted environment.<\/p>\n

To operate malicious campaigns, Cavern Manticore uses its own modular C2 framework, described by the researchers as \u201ca mature and adaptable toolset built around a shared .NET foundation.\u201d<\/p>\n

The framework is made of two main components tracked by Check Point as\u00a0Cavern agent\u00a0and\u00a0Cavern modules:<\/p>\n