2026年7月22日の
セキュリティ情報

Subject: [Intel] New Modular Backdoor 'Cavern' used by Iran-linked Actor

Dear Team,

We are sharing intelligence regarding a new modular C2 framework named 'Cavern' used by the Iran-linked threat actor Cavern Manticore.

■ Overview
Cavern is a .NET-based modular backdoor that allows attackers to deploy specific functional modules (Communication, File Manager, SQL Browser, LDAP, Network, and Tunnel) depending on the target environment. It features self-updating capabilities and automatic directory cleanup to evade detection and forensics.

■ Scope
- Environments utilizing remote monitoring and management (RMM) software such as SysAid.
- Primary targets: Israeli government and IT service providers.

■ Recommended Actions
1. Ensure all RMM software (e.g., SysAid) is fully patched and updated to the latest version.
2. Enhance monitoring for suspicious .NET binaries and unusual outbound network traffic via EDR/SIEM.
3. Enforce Multi-Factor Authentication (MFA) for privileged accounts to mitigate lateral movement.

■ Reference
- Check Point Research

Priority: Medium
Deadline: Ongoing

Subject: [Threat Intel] Attack Campaign by Ransomware Group 'The Gentlemen'

Dear Team,

We are sharing information regarding the emerging ransomware group 'The Gentlemen'.

■ Overview
This actor gains initial access via vulnerabilities in internet-facing services or stolen credentials, often collaborating with Initial Access Brokers (IABs). They deploy a custom Go-based backdoor for reconnaissance and remote command execution before deploying ransomware (including a newly discovered C-based variant).

■ Scope
- Broad industrial sectors: Manufacturing, IT, Healthcare, Finance, Construction, and Logistics.
- Vulnerable internet-facing services and compromised accounts.

■ Recommended Actions
1. Conduct vulnerability scans on all external assets and prioritize patching.
2. Enforce Multi-Factor Authentication (MFA) on all external access points (VPN, RDP, etc.).
3. Monitor EDR and network logs for suspicious outbound traffic originating from unknown Go-based binaries.

■ Reference
- Kaspersky GReAT Report

Priority: High
Deadline: Immediate review