apt

Cavern Manticore

active · last signal 2mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

SiameseKitten (overlap)

Attribution

Iran-nexus actor assessed by Check Point Research to be linked to Iran's Ministry of Intelligence and Security (MOIS), with technical overlaps to the OilRig subgroup Lyceum

Origin

Iran

First seen

2026

Last active

2026

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Israel

Sectors

IT / managed service providers (RMM software), government

Corpus activity · 6mo2 mentions

AMJJAS

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (IT / managed service providers (RMM software), government sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BahamutactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
payload · XMRigcampaignCorrelated cluster2026-09-03
Cavern Manticore · CaverncampaignCorrelated cluster2026-07-08

Uses

Develop Capabilities: MalwaretechniqueATT&CK mapping
Supply Chain Compromise: Compromise Software Supply ChaintechniqueATT&CK mapping
Obfuscated Files or Information: Steganography

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

SectorGovernmentco-mentioned in 2 items
CVECVE-2026-14381co-mentioned in 1 item
CountryIranco-mentioned in 1 item
CVECVE-2026-14396co-mentioned in 1 item
CVECVE-2026-8451co-mentioned in 1 item
CVECVE-2026-14422co-mentioned in 1 item
CVECVE-2026-20243co-mentioned in 1 item
CVECVE-2026-14384co-mentioned in 1 item
CVECVE-2026-20214co-mentioned in 1 item
CVECVE-2026-14410co-mentioned in 1 item
MalwareCavernco-mentioned in 1 item
CVECVE-2026-20216co-mentioned in 1 item
CVECVE-2026-58523co-mentioned in 1 item
CVECVE-2026-20217co-mentioned in 1 item
CVECVE-2026-20215co-mentioned in 1 item
CVECVE-2026-14415co-mentioned in 1 item
CVECVE-2026-20191co-mentioned in 1 item
CVECVE-2026-20244co-mentioned in 1 item
CVECVE-2026-20213co-mentioned in 1 item
SectorIT service providersco-mentioned in 1 item
Malwaren-HTCommp.dllco-mentioned in 1 item
TechniqueT1071co-mentioned in 1 item
SectorIT providersco-mentioned in 1 item
TechniqueT1574.002co-mentioned in 1 item
MalwareCavern Agentco-mentioned in 1 item
MalwareCavern frameworkco-mentioned in 1 item
CountryIsraelco-mentioned in 1 item

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

SectorGovernmentco-mentioned in 2 items
CVECVE-2026-14381co-mentioned in 1 item
CountryIranco-mentioned in 1 item
CVECVE-2026-14396co-mentioned in 1 item
CVECVE-2026-8451co-mentioned in 1 item
CVECVE-2026-14422co-mentioned in 1 item
CVECVE-2026-20243co-mentioned in 1 item
CVECVE-2026-14384co-mentioned in 1 item
CVECVE-2026-20214co-mentioned in 1 item
CVECVE-2026-14410co-mentioned in 1 item
MalwareCavernco-mentioned in 1 item
CVECVE-2026-20216co-mentioned in 1 item
CVECVE-2026-58523co-mentioned in 1 item
CVECVE-2026-20217co-mentioned in 1 item
CVECVE-2026-20215co-mentioned in 1 item
CVECVE-2026-14415co-mentioned in 1 item
CVECVE-2026-20191co-mentioned in 1 item
CVECVE-2026-20244co-mentioned in 1 item
CVECVE-2026-20213co-mentioned in 1 item
SectorIT service providersco-mentioned in 1 item
Malwaren-HTCommp.dllco-mentioned in 1 item
TechniqueT1071co-mentioned in 1 item
SectorIT providersco-mentioned in 1 item
TechniqueT1574.002co-mentioned in 1 item
MalwareCavern Agentco-mentioned in 1 item
MalwareCavern frameworkco-mentioned in 1 item
CountryIsraelco-mentioned in 1 item