Iranian hackers use new modular C2 framework against Israeli organizations

SCM feed for Latest

July 6, 2026 at 11:26 PM

Actively Exploited

Overview

Check Point Research has identified a new group of Iranian hackers using a modular command and control (C2) framework called Cavern Manticore. This group shows tactical similarities to other known hacking organizations like MuddyWater and Lyceum. Their activities have primarily targeted Israeli organizations, raising concerns about the potential for increased cyberattacks in the region. The modular nature of their framework suggests that the hackers can easily adapt and evolve their tactics, making it challenging for defenders to keep up. This development underscores the ongoing cyber threats facing critical infrastructure and organizations in Israel.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Israeli organizations, particularly those in critical infrastructure sectors.
Action Required: Organizations should enhance their cybersecurity measures, including monitoring for unusual network activity and applying security patches promptly.
Timeline: Newly disclosed

Original Article Summary

The threat cluster, dubbed Cavern Manticore by Check Point Research, exhibits tactical similarities with known groups like MuddyWater and Lyceum.

Impact

Israeli organizations, particularly those in critical infrastructure sectors.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance their cybersecurity measures, including monitoring for unusual network activity and applying security patches promptly.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical, Check Point.

Read Original Article

Related Coverage

Spain arrests suspected member of pro-Russian hacktivist groups

BleepingComputer

Spanish authorities have arrested a man believed to be involved with two pro-Russian hacktivist groups, CyberArmy of Russia Reborn (CARR) and Z-Pentest. The arrest is part of a broader effort to crack down on cyber activities linked to the ongoing geopolitical tensions involving Russia. These groups are known for their cyber operations that support Russian interests, which raises concerns about potential cyberattacks aimed at various targets. This incident highlights the increasing intersection of cybercrime and geopolitical conflicts, emphasizing the need for vigilance among individuals and organizations regarding their cybersecurity practices. As such groups continue to operate, their activities could pose risks to critical infrastructure and sensitive data across Europe and beyond.

Jul 7, 2026

Scattered Spider’s Structure More Like a Cybercrime Collective Than a Unified Gang

Infosecurity Magazine

Research from Group-IB has revealed that Scattered Spider operates more like a decentralized collective rather than a traditional cybercrime gang. This group consists of independent clusters that work together on various cybercriminal activities, making it difficult for law enforcement to track and dismantle their operations. Each cluster appears to have its own unique methods and targets, which could complicate efforts to combat their activities. This decentralized structure poses a significant challenge for cybersecurity professionals, as it allows for greater flexibility and resilience among attackers. Understanding this new model is crucial for organizations looking to defend against potential threats from such groups.

Jul 7, 2026

I enabled Android's new security feature that detects fake cell towers - here's why

What Changes When Your Software Supply Chain Includes AI Writing Your Code?

The Hacker News

The article discusses the implications of incorporating artificial intelligence into software development, particularly focusing on supply chain security. Traditionally, developers needed to be cautious about the open-source libraries and dependencies they included in their code, as vulnerabilities in these components could lead to significant security breaches. High-profile incidents like SolarWinds and Log4Shell have underscored this risk. With AI now generating code, there are new concerns about the security of these AI-generated components and how they could introduce unforeseen vulnerabilities. This shift means that companies must adapt their security practices to account for the potential flaws in AI-written code, which could complicate the already challenging landscape of software supply chain security. Understanding and managing these risks is crucial for maintaining the integrity of software systems.

Jul 7, 2026

Malicious websites trick AI agents into crypto payments, context poisoning

SCM feed for Latest

Researchers have discovered a new method of attack that involves malicious websites using indirect prompt injections hidden in HTML to trick AI agents into making unauthorized cryptocurrency payments. This tactic specifically targets developers and cryptocurrency owners, potentially leading to significant financial losses. By embedding deceptive scripts within seemingly harmless web pages, attackers can manipulate AI tools to perform actions without the user's consent or knowledge. This issue raises concerns about the security of automated systems, particularly in the crypto space, where transactions can be irreversible. Users and developers need to be vigilant about the websites they visit and consider implementing additional security measures to protect against these types of attacks.

Jul 7, 2026

Threat landscape for industrial automation systems. Q1 2026

Securelist

The report outlines the state of cybersecurity threats targeting industrial automation systems in the first quarter of 2026. It presents statistics on various types of threats, their sources, and the regions and industries most affected. Key findings indicate a rise in attacks on critical infrastructure, with specific vulnerabilities identified in operational technology systems. This trend poses significant risks to industries like manufacturing and energy, where disruptions can lead to safety hazards and financial losses. Companies operating in these sectors are urged to enhance their security measures to mitigate the growing number of cyber threats.

Jul 7, 2026