Introduction
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE’s TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity. Dragos Hexane Kaspersky Lyceum October 2021 ClearSky Siamesekitten August 2021 Accenture Lyceum Targets November 2021
Activities and Tactics
Targeted Sectors: Government, Energy, High-Tech, Telecomms, Education, Military, Defense
Country of Origin: 🇮🇷 Iran
Incident Type: Espionage
Suspected Victims: Israel, Middle East
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1016 System Network Configuration Discovery
- T1555 Credentials from Password Stores
- T1027.010 Command Obfuscation
- T1589 Gather Victim Identity Information
- T1082 System Information Discovery
- T1583.001 Domains
- T1110 Brute Force
- T1053.005 Scheduled Task
- T1204.002 Malicious File
- T1567.002 Exfiltration to Cloud Storage
- T1585.001 Social Media Accounts
- T1016.001 Internet Connection Discovery
- T1546.003 Windows Management Instrumentation Event Subscription
- T1069.001 Local Groups
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1586.002 Email Accounts
- T1110.003 Password Spraying
- T1102.002 Bidirectional Communication
- T1588.002 Tool
- T1555.003 Credentials from Web Browsers
- T1059.001 PowerShell
- T1608.001 Upload Malware
- T1589.002 Email Addresses
- T1585.002 Email Accounts
- T1033 System Owner/User Discovery
- T1105 Ingress Tool Transfer
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1056.001 Keylogging
- T1518 Software Discovery
- T1059.005 Visual Basic
- T1010 Application Window Discovery
- T1591.004 Identify Roles
- T1583.002 DNS Server
- T1534 Internal Spearphishing
ATT&CK technique IDs (denormalized)
- T1010
- T1016
- T1016.001
- T1018
- T1021.001
- T1027.010
- T1033
- T1049
- T1053.005
- T1056.001
- T1057
- T1059.001
- T1059.005
- T1069.001
- T1082
- T1102.002
- T1105
- T1110
- T1110.003
- T1204.002
- T1518
- T1534
- T1546.003
- T1555
- T1555.003
- T1567.002
- T1583.001
- T1583.002
- T1585.001
- T1585.002
- T1586.002
- T1588.002
- T1589
- T1589.002
- T1591.004
- T1608.001
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- Milan (S1015) — malware
- Ping (S0097) — tool
- netstat (S0104) — tool
- BITSAdmin (S0190) — tool
- Shark (S1019) — malware
- DnsSystem (S1021) — malware
- DanBot (S1014) — malware
- Empire (S0363) — tool
- ipconfig (S0100) — tool
- Mimikatz (S0002) — tool
- Kevin (S1020) — malware
- PoshC2 (S0378) — tool
Attribution and Evidence
Country of Origin: Iran Additional attribution information pending cataloguing.
References
[1] mitre-attack [5] Accenture Lyceum Targets November 2021 Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022. [6] ClearSky Siamesekitten August 2021 ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022. [7] Dragos Hexane Dragos. (n.d.). Hexane. Retrieved October 27, 2019. [8] Kaspersky Lyceum October 2021 Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. [9] SecureWorks August 2019 SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19