Home › Threat Actors › Cavern Manticore
← All Threat Actors
Nation-State high Iran — MOIS (Cavern Manticore) and IRGC (APT42/Charming Kitten)

Cavern Manticore

Two related Iranian operations covered jointly in this briefing. Cavern (aka Cav3rn) C2 framework is linked to Cavern Manticore, assessed to be affiliated with Iran's Ministry of Intelligence and Security (MOIS), sharing infrastructure/operational patterns with MuddyWater and the OilRig sub-group Lyceum. APT42 (Charming Kitten) is separately described as IRGC-linked. · Espionage and intelligence collection; APT42 specifically targeting nuclear energy sector personnel for surveillance

Reports 1
Active Since Cavern C2 framework first publicly documented July 2026; Kaspersky has tracked the cluster since December 2025
Last Reported 18 Aug 2026
Sectors Targeted critical-infrastructure, communications, finance

Tactics, Techniques & Procedures (TTPs)

  • GoogleService.dll: DNS A-record query at runtime selects between a Google Apps Script C2 relay and direct HTTPS, allowing real-time relay switching without redeploying implants
  • rnp.dll inter-component broker: local routing layer loading DLL components, routing inter-module messages, supporting in-place upgrades
  • HOLLOWGRAPH: .NET NativeAOT implant abusing Microsoft Graph API to use compromised M365 mailbox calendars as a bidirectional C2 dead-drop (tasking planted as calendar events dated 2050 to avoid detection)
  • DNS tunneling used by HOLLOWGRAPH to refresh expired Microsoft Entra ID OAuth tokens
  • APT42: spear-phishing with LNK files masquerading as PDFs, using podcast/interview lures
  • TAMECAT: modular framework for enumeration, command execution, browser credential harvesting, Outlook .ost mailbox collection, screenshot capture, fallback C2; generative AI used to accelerate targeting research, translation, and tooling

Known Targets

Communications sectorFinance sectorCritical infrastructureNuclear energy sector personnel (APT42/TAMECAT)

Analyst Notes

Article presents Cavern Manticore and APT42 as parallel but distinct Iranian campaigns in the same briefing, not as a single merged entity — treat as related-but-separate pending clearer vendor consensus.

Also Known As

CavernCav3rnCavern ManticoreAPT42Charming KittenCavern Manticore / APT42 (previous page label)

MITRE ATT&CK Techniques

T1071.004 Application Layer Protocol: DNS T1102.002 Web Service: Bidirectional Communication T1566.001 Phishing: Spearphishing Attachment T1114.001 Email Collection: Local Email Collection T1113 Screen Capture

Intelligence Reports

Briefing critical-infrastructurecommunications

Cavern C2 Evolves: Iranian MOIS Group Adds Google Apps Script and M365 Calendar Channels

Kaspersky and Group-IB analysis reveals Iranian MOIS-linked Cavern Manticore has extended its C2 framework with DNS-directed Google Apps Script relays and a new HOLLOWGRAPH module abusing Microsoft 365 calendar events — while APT42 separately targets the nuclear energy sector with AI-accelerated TAMECAT implants.

18 Aug 2026 · 4 min read