Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations. The activity, which has primarily singled out IT providers and government sectors, has been attributed to a threat cluster tracked by Check Point Research Ira…

https://thehackernews.com/2026/07/iran-linked-hackers-use-new-cavern-c2.html

sha256:c270af4e8a17635ed4f05f447211ceb9c70168226411a9a75edac339d9e11098

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve7
md50
url0
ipv40
ipv60
sha10
domain8
sha2560
malware_token1
attack_pattern0
threat_actor_token2

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2025-68613	Open →
cve	CVE-2025-34291	Open →
domain	uxtheme.dll	Open →
domain	n-htcommp.dll	Open →
domain	mhm.dll	Open →
domain	db.dll	Open →
domain

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports