Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks

Researchers say the Iran-linked threat actor used an adaptable modular malware framework and compromised IT service providers to reach high-value targets in Israel. The post Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks appeared first on SecurityWeek .

SecurityWeek reports that an Iran-linked APT group dubbed Cavern Manticore is using a modular command-and-control framework (Cavern/Cav3rn) and compromising IT service providers as an access vector to high-value Israeli government and IT sector targets.[1][3][4] These attacks leverage a flexible, plug-in style malware architecture and abuse trusted third-party providers to propagate into downstream organizations.[1][3] From a RealGround perspective, this highlights AI and software supply chain exposure: any AI-enabled services, models, or orchestration platforms operated by compromised IT providers could be used to deploy or manage malware, manipulate logs or telemetry, or exfiltrate data through trusted channels. Organizations should treat IT and managed service providers as critical supply chain nodes, require SBOM and security attestations for AI-related components, and implement independent monitoring and segmentation so that compromise of a provider cannot directly pivot into core AI systems and business logic.