Vulnerabilityhigh
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-34291 | CORS Origin Validation Flaw in Langflow Enables Account Takeover and RCE | 9.4 | 93% | KEVPoC | KEV |
| CVE-2025-52691 | Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail | 10.0 | 86% | KEVRansomwarePoC ×2 | KEV |
| CVE-2025-54068 | Unauthenticated Code Injection RCE in Laravel Livewire v3 | 9.2 | 96% | KEVPoC | KEV |
| CVE-2025-68613 | Authenticated RCE in n8n Workflow Automation Expression Evaluation | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-9316 | Unauthenticated Session ID Generation Flaw in N-able N-central | 6.9 | 36% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hospitalinstallation.com | ion DLL module ("n-HTCommp.dll") to contact the C2 server ("hospitalinstallation[.]com") and fetch additional post-exploitation modules on the f |
From the original article
4 min read at thehackernews.com
An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.