HEXANE

Threat Actors · HEXANE

· ATT&CK GroupG1001

LyceumSiamesekittenSpirlin

Techniques

Software

Tactics

Aliases

Description

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Tactic Coverage

discovery (10)resource development (7)credential access (5)execution (4)reconnaissance (3)lateral movement (2)persistence (2)privilege escalation (2)command and control (2)stealth (1)collection (1)exfiltration (1)

Techniques Used (36)

T1010Application Window Discovery

discovery

T1016System Network Configuration Discovery

discovery

T1016.001Internet Connection Discovery

discovery

T1018Remote System Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 36 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (12)

S0190BITSAdmintool S1014DanBotmalware S1021DnsSystemmalware S0363Empiretool S1020Kevinmalware S1015Milanmalware S0002Mimikatztool S0097Ping

References (9)

https://attack.mitre.org/groups/G1001 https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns https://www.clearskysec.com/siamesekitten/https://dragos.com/resource/hexane/https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign