Tel Aviv, Israel – Israeli cybersecurity firm Check Point revealed in a detailed report released Monday a dangerous development in cyber offensive capabilities linked to Iran. The report stated that a hacking group calling itself Cavern Manticore, believed to be affiliated with Iran’s Ministry of Intelligence and Security, has developed a new software framework specifically designed to attack Israeli organizations in the government and IT sectors. Furthermore, this framework possesses a superior ability to evade traditional detection and analysis systems.
Advanced tactics for camouflage and expansion
According to Check Point Research Center (CPR), which has been monitoring this group’s activity since early 2026, the new framework gives attackers significant flexibility in tailoring attacks to different technological environments. The danger of this system lies in its ability to limit the data that defenders can recover after a breach. Furthermore, it expands access within targeted networks through specialized software modules designed to collect data and penetrate deep into an organization’s infrastructure.
Exploiting the technological “supply chain”
The report explained that the group adopted a cunning strategy, beginning its attacks by infiltrating trusted IT service providers in Israel. Through these providers, the group deployed its new tool, which performs multiple tasks, including downloading additional software, searching files and internal networks, and testing passwords to deepen the infiltration.
Even more alarming is the tool’s design to exploit Remote Management Mechanisms (RMM) solutions, allowing attackers to transfer complete control of devices to a third party. By disguising themselves as legitimate software updates sent from the service provider to its customers, these malicious tools were able to infiltrate victims’ devices without raising suspicion in the initial stages.
A precise understanding of Israeli vulnerabilities
Researchers at the company found multiple instances where the breach spread from one service provider to another in an interconnected chain. This suggests that Cavern Manticore possesses a detailed and in-depth understanding of IT supply chains within Israel. The Check Point research center warned that this group represents a qualitative leap in Iranian cyber capabilities. This is achieved through a system capable of rapidly adapting to new campaigns and changing operational objectives, making countering these attacks a significant challenge for cyber defense teams in both government and private institutions.
