A cyber intrusion campaign attributed to an Iran-linked advanced persistent threat group operating under the 'Cavern' command-and-control framework is actively targeting Israeli organizations. The attack exploits vulnerabilities in SysAid's software update mechanism through DLL side-loading, delivering a trojanized uxtheme.dll file that deploys the Cavern Agent. The campaign demonstrates a supply chain compromise strategy, focusing on IT service providers and government sector entities. Indicators of compromise have been published, and ongoing beaconing behavior from compromised systems confirms sustained presence.