Loading malware…
DanBot is a Windows remote access trojan and backdoor associated with the Iranian espionage cluster tracked as Lyceum, also known as Hexane and SiameseKitten, and linked by multiple researchers to OilRig/APT34 activity. It appeared in Lyceum intrusion chains from at least 2018 and was later supplemented or replaced in some operations by the Shark, Milan, and Marlin backdoors. DanBot has been used in cyberespionage campaigns targeting organizations in the Middle East, including diplomatic, technology, medical, IT, and communications sectors, with notable victimology in Israel, Tunisia, and the United Arab Emirates.
DanBot has commonly been delivered through spearphishing emails carrying malicious Excel attachments. These lures relied on user execution and embedded VBA macros to drop the payload onto the victim system. The malware has also been observed establishing persistence through Windows Scheduled Tasks. In addition to masquerading as legitimate remote administration software, DanBot samples have used names intended to resemble VNC utilities, consistent with defense-evasion tradecraft.
Functionally, DanBot provides remote access capabilities and has been observed uploading files from compromised hosts, supporting post-compromise collection and exfiltration workflows. Reporting on related Lyceum tooling indicates overlapping design and operational patterns across the group’s backdoors, including similar command execution behavior and shared implementation artifacts, placing DanBot within a broader long-running Iranian cyberespionage ecosystem focused on persistent access and intelligence collection.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Lyceum infection chains are also notable for the fact that they have evolved to drop multiple backdoors since the campaign came to light in 2018 — beginning with DanBot and transitioning to Shark and Milan in 2021...
Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
20 distinct techniques documented for this family, organized by ATT&CK tactic.
ESET, noting that initial access to the network was achieved by means of spear-phishing as well as remote access and administration software like ITbrain and TeamViewer
The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.