Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting Israeli organizations, with a focus on IT providers, and government sectors. Cavern Manticore is an Iran MOIS (Ministry of Intelligence and Security)-linked actor, with links to the OilRig […] The post Cavern Manticore…

https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework

sha256:5125c1b1ba91ef4397c6fb8d7fd924eb1499939969cecfef4bcca15814672a70

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url3
ipv41
ipv60
sha10
domain50
sha25614
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	google.com	Open →
domain	index.htm	Open →
domain	asp.net	Open →
domain	mpr.dll	Open →
domain	config.txt	Open →
ip	146.0.0.0	Open →
domain	windirstat.exe

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

MuddyWater

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports