Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Check Point Research publications from May–July 2026 describe multiple high-impact findings: a newly tracked Iran-linked APT dubbed “Cavern Manticore” (MOIS/OilRig nexus) using a modular command-and-control (C2) framework to target Israeli organizations (notably IT providers and government); continued Iran-nexus activity from Nimbus Manticore (UNC1549) including destructive and cloud-exfiltration operations; exploitation techniques and incidents across the ecosystem such as supply-chain compromises, a crypto clipboard hijacker, and browser-only ransomware leveraging LLM workflows; and a novel,