HEXANE
HEXANE, also known as Lyceum, Siamesekitten, Spirlin, and Storm-0133, is an Iran-linked threat actor. Dragos identified HEXANE targeting oil and gas companies in the Middle East, including Kuwait as a primary operating region. The group also targeted telecommunication providers in the greater Middle East, Central Asia, and Africa, potentially as a steppingstone to network-focused man-in-the-middle and related attacks. Reported objectives include credential harvesting, network mapping, and initial-access brokering for Lyceum. Observed tradecraft includes delivery via malicious file attachments sent by email or embedded in actor-controlled websites; use of cloud services including OneDrive for command and control and data exfiltration; process enumeration; host and user discovery including collecting hostnames and running whoami; network discovery using ping, tracert, and net view; credential access using cmdkey to identify stored credentials and a Mimikatz-based tool plus PowerShell script to steal Google Chrome passwords; persistence via a scheduled task for a keylogger; lateral movement via remote desktop sessions; and use of PowerShell-based tools and scripts for discovery and collection. The actor has also acquired and sometimes customized open-source tools including Mimikatz, Empire, VNC remote access software, and DIG.net.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Telecommunication Services
Where they target
Geographies tied to known operations.
- 🇰🇼 Kuwait
Tradecraft
51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
15 malware families attributed to this actor across reporting.
10 additional families tracked in Mallory.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
63 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with the malicious file execution technique detected by this analytic.
Listed as a threat actor associated with use of Cobalt Strike PowerShell loader patterns.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.