HEXANE

Lyceum, also known as HEXANE, SiameseKitten, Spirlin, and Storm-0133, is an Iranian cyberespionage threat actor active since at least 2017. It targets strategically important organizations across the Middle East and Africa, particularly energy, oil and gas, telecommunications, and information technology companies. Documented targets include organizations in Israel, Saudi Arabia, Tunisia, and Morocco. Lyceum has substantial technical and operational connections to OilRig (APT34) and has been characterized as an OilRig subgroup. The actor uses spear-phishing, malicious Office documents, executable droppers, and recruitment-themed social engineering to obtain access. Campaigns against Israeli IT and communications companies have impersonated recruiters and legitimate employers through fabricated LinkedIn profiles, phishing websites, and job offers. Such targeting supports supply-chain espionage objectives by positioning the attackers to reach service providers’ customers. Other campaigns have used geopolitical news, including the Russia–Ukraine war, as phishing lures. Lyceum’s toolset includes DanBot, Milan, Shark, modified DnsDig-based malware, and additional .NET and Go backdoors. Its implants support arbitrary command execution, screenshots, host and application discovery, and file transfer. The actor uses DNS tunneling alongside HTTP, HTTPS, and TCP command-and-control channels, with some backdoors supporting multiple communication methods. Persistence mechanisms include scheduled tasks and execution through the Windows Startup folder. Credential-access activity includes Mimikatz-based tooling and PowerShell scripts for stealing saved Google Chrome passwords, as well as PowerShell keyloggers launched through VBScript. Post-compromise discovery includes process enumeration, hostname collection, and identification of the current user. Lyceum also uses obfuscation, encoded configurations, and impersonation of legitimate software and services to conceal malicious activity.