According to a report published by the Israeli cybersecurity organization “Check Point Research” a new Iranian advanced persistent threat group has emerged. This group, named “Cavern Manticore”, has been targeting the Israeli government and the country’s IT sector. The hacking group is linked to the Islamic Republic, and an examination of its methods reveal similarities to other groups affiliated with Iran’s Ministry of Intelligence and Security, such as “MuddyWater” and “Lyceum.”

According to the Israeli cybersecurity organization, Cavern Manticore began its activity in early 2026 and has recently been observed using a new C2 framework.

These developments have occured during the Israeli and U.S. operations against Iran, and indicate that the capabilities of Iranian cyber groups are advancing.