Iran-nexus actor assessed by Check Point Research to be linked to Iran's Ministry of Intelligence and Security (MOIS), with technical overlaps to the OilRig subgroup Lyceum
Origin
Iran
First seen
2026
Last active
2026
Motivation
Espionage
Attribution confidence
medium
MENA targeting
Israel
Sectors
IT / managed service providers (RMM software), government
Corpus activity · 6mo2 mentions
AMJJAS
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (IT / managed service providers (RMM software), government sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.
built the custom modular .NET Cavern C2 framework (CPR)
Regional co-occurrence · associated techniques
Honesty note
Regional co-occurrence is association, not prediction. These techniques appeared alongside Cavern Manticore's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.
Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.
protect · 2 techniques
Role Based Access ControlT1199partialAntimalwareT1027significant
Quarantine PoliciesT1027significantZero Hour Auto PurgeT1027significant
Countermeasures · D3FEND
Defensive techniques that counter Cavern Manticore's TTPs, from MITRE D3FEND. The ATT&CK↔D3FEND link is mitigation-mediated — treat these as candidate countermeasures, not prescriptions.