CVE-2025-54068

An Iranian hacking group linked to the Ministry of Intelligence and Security (MOIS), tracked as Cavern Manticore, has been using a new modular command-and-control (C2) framework named Cavern to target Israeli organizations, particularly in the IT and government sectors. The attack leverages DLL side-loading via SysAid's software update mechanism, deploying a trojanized DLL (uxtheme.dll) that communicates with a C2 server and downloads additional malicious modules. These modules enable reconnaissance, data theft, lateral movement, and tunneling, with a sophisticated .NET-based architecture using mixed compilation formats to hinder analysis. The group exploits trusted relationships in the software supply chain and has shifted from broad reconnaissance to targeted data exfiltration across Middle Eastern sectors.

The article covers multiple cyber threats including the disruption of the NetNut residential proxy network, which leveraged compromised home devices to route malicious traffic. Threat actors are targeting researchers with fake proof-of-concept repositories delivering the ChocoPoC RAT, while the Scattered Spider group is linked to extortion attempts. New malware such as Ousaban and browser-based ransomware exploit social engineering and legitimate browser APIs, and AI-driven attacks are increasing in sophistication, including indirect prompt injection and fake phishing pages generated via AI.