Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

MITRE Techniques

• [T1071.001] Web Protocols – The framework uses HTTP and WebSocket for C2 communication and tunneling through modules like n-HTCommp.dll and n-sws.dll (‘direct HTTPS / WebSocket’, ‘WebSocket/WSS tunnel’).
• [T1573.001] Symmetric Cryptography – Traffic is encoded with XOR key 0x48 before transmission on C2-bound paths (‘XORed with key 0x48’, ‘traffic-encoding layer’).
• [T1027] Obfuscated Files or Information – The framework hides behavior through compilation format choices and packed runtime data, making static analysis difficult (‘the compilation format itself becomes the anti-analysis layer’, ‘packed verb constants’).
• [T1218.011] Rundll32 – DLL Side-Loading – The initial execution chain abuses legitimate software loading a trojanized DLL, specifically WinDirStat loading uxtheme.dll (‘WinDirStat DLL sideloading package’, ‘loads the trojanized uxtheme.dll’).
• [T1562.001] Disable or Modify Tools – The framework reduces analyst visibility through anti-analysis and anti-forensics mechanisms such as AppDomain isolation and cleanup (‘loaded modules can be cleanly removed from memory’, ‘aggressive directory cleanup’).
• [T1070.004] File Deletion – New agent builds delete files and subdirectories in the working directory after startup (‘delete everything except the Communication Module, config.txt, and log files’).
• [T1135] Network Share Discovery – The network module enumerates shares and mapped drives (‘share enumeration’, ‘list shares on a host’).
• [T1046] Network Service Discovery – The network module performs network reconnaissance and TCP port scanning (‘port scan’, ‘TCP port scan’).
• [T1087.002] Domain Account Discovery – LDAP and network modules enumerate users, groups, and local accounts (‘enumerate all users’, ‘local group members’).
• [T1018] Remote System Discovery – The network module discovers computers in the domain and performs netstat/ARP-style discovery (‘list computers in domain’, ‘ARP table’).
• [T1083] File and Directory Discovery – File module functions list drives, folders, files, and search content (‘drive/file/directory enumeration’, ‘search files’).
• [T1005] Data from Local System – The file module collects host information and browses local files and databases (‘host information collection’, ‘database browsing’).
• [T1555.004] Credentials from Password Stores – The file manager module decrypts DPAPI-protected blobs with the current user context (‘DPAPI decryption’, ‘decrypt any DPAPI-protected secret’).
• [T1021.002] SMB/Windows Admin Shares – The network module maps/unmaps drives and brute-forces SMB access using WNetAddConnection2 (‘SMB-based credential spraying primitive’).
• [T1078] Valid Accounts – The actor abuses legitimate RMM access and operator-supplied credentials for LDAP/SQL/network operations (‘abuse of existing Remote Monitoring and Management software’, ‘operator-supplied credential pairs’).
• [T1190] Exploit Public-Facing Application – The initial foothold is described as starting from abused management software and SysAid server functionality (‘SysAid’s software update feature’, ‘deploy a WinDirStat DLL sideloading package’).