A reported Iran-linked cluster is using a modular .NET command-and-control framework for reconnaissance and lateral movement, showing how modern implants can hide behind ordinary software patterns.