HEXANE
Also known as:Lyceum · Siamesekitten · Spirlin
Overview
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.
Naming & attribution
HEXANE is tracked under 4 names across the industry. It uses 36 documented ATT&CK techniques — more than 72% of the 174 groups tracked here. Activity attributed since at least 2017.
| Name | First reported by |
|---|---|
| Siamesekitten | ClearSky Cyber Security |
| Spirlin | Accenture |
Distinctive techniques
Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.
T1010Application Window Discovery — used by 3 of 174 groupsT1583.002DNS Server — used by 3 of 174 groups
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- Magic Hound Iran — 23 shared techniques (25% overlap)
- OilRig Iran — 20 shared techniques (22% overlap)
- MuddyWater Iran — 19 shared techniques (22% overlap)
- Sandworm Team Russia — 19 shared techniques (20% overlap)
- FIN8 — 12 shared techniques (20% overlap)
- Moonstone Sleet North Korea — 11 shared techniques (20% overlap)
Malware families with tracked indicators
One family attributed to HEXANE, with 11 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- PoshC211 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
Targets
Defense · Education · Energy · Government · High-Tech · Military · Telecommunications
Regions
Israel · Middle East
Capabilities
- Custom malware/implant development — ATT&CK: 5 attributed custom malware families
TTPs — 36 techniques across 11 tactics
Reconnaissance
T1589Gather Victim Identity InformationT1589.002Email AddressesT1591.004Identify Roles
Resource Development
T1583.001DomainsT1583.002DNS ServerT1585.001Social Media AccountsT1585.002Email AccountsT1586.002Email AccountsT1588.002ToolT1608.001Upload Malware
Execution
T1053.005Scheduled TaskT1059.001PowerShellT1059.005Visual BasicT1204.002Malicious File
Privilege Escalation
Stealth
T1027.010Command Obfuscation
Credential Access
T1110Brute ForceT1110.003Password SprayingT1555Credentials from Password StoresT1555.003Credentials from Web Browsers
Discovery
T1010Application Window DiscoveryT1016System Network Configuration DiscoveryT1016.001Internet Connection DiscoveryT1018Remote System DiscoveryT1033System Owner/User DiscoveryT1049System Network Connections DiscoveryT1057Process DiscoveryT1069.001Local GroupsT1082System Information DiscoveryT1518Software Discovery
Lateral Movement
T1021.001Remote Desktop ProtocolT1534Internal Spearphishing
Collection
T1056.001Keylogging
Command and Control
T1102.002Bidirectional CommunicationT1105Ingress Tool Transfer
Exfiltration
T1567.002Exfiltration to Cloud Storage
Tools & malware (12)
Milan · Ping · netstat · BITSAdmin · Shark · DnsSystem · DanBot · Empire · ipconfig · Mimikatz · Kevin · PoshC2
Reporting (3)
- Who are latest targets of cyber group Lyceum? — Accenture
- LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST — Kayal, A. et al
- New Iranian Espionage Campaign By “Siamesekitten” - Lyceum — ClearSky Cyber Security