Iranian APT DNS-transport C2 research. Investigation into Cavern Manticore / Project CAV3RN infrastructure, yielding a novel RFC 2308 non-compliance fingerprint for DNS-transport C2 servers. Two unreported relays documented from public data. Sigma, KQL, Suricata, sweep tooling. Graded evidence, full retraction log.
iran threat-intelligence dns-tunneling dns-tunneling-detection muddywater iranian-apt cavern-manticore cav3rn oilrig
-
Updated
Aug 25, 2026