HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.1234
- Dragos Hexane
- Kaspersky Lyceum October 2021
- ClearSky Siamesekitten August 2021
- Accenture Lyceum Targets November 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | HEXANE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Lyceum | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Siamesekitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Spirlin | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1010 | Application Window Discovery | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1069.001 | Local Groups | — |
| T1082 | System Information Discovery | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1110.003 | Password Spraying | — |
| T1204.002 | Malicious File | — |
| T1518 | Software Discovery | — |
| T1534 | Internal Spearphishing | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1583.001 | Domains | — |
| T1583.002 | DNS Server | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.002 | Email Addresses | — |
| T1591.004 | Identify Roles | — |
| T1608.001 | Upload Malware | — |
Aliases
HEXANE · Lyceum · Siamesekitten · Spirlin
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.