216.73.217.22

HEXANE

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:13
Updated at
27/03/2026 01:13
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
43 attack patterns (mitre), 5 malware, 7 indicators, 7 tool, 1 campaign

Aliases

Lyceum Siamesekitten Spirlin

Description

[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (43)

Malware (5)

  • Milan
  • Kevin
  • Shark
  • DanBot
  • DnsSystem

Indicators (7)

  • http://news-spot.live/Reports/1/45/DnsSystem.exe indicates
  • ba73116c7cf6faf3aa97b497cf7472b2a115a3b5ad7ad85f7919ff81a1ff2b9a indicates
  • http://news-spot.live/Reports/1/?id=1111&pid=a40 indicates
  • 221292a9f77f1a16fa0a7ed41b0eedbd312475dd9a5104c7923ed7889ea0f292 indicates
  • http://news-spot.live/Reports/1/?id=1111&pid=a52 indicates
  • http://news-spot.live/Reports/1/?id=1111&pid=a28 indicates
  • cyberclub.one indicates

Tool (7)

  • netstat uses
    The MITRE Corporation Confidence 100

    [netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • BITSAdmin uses
    The MITRE Corporation Confidence 100

    [BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)

    Published 18/04/2018 19:59 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • ipconfig uses
    The MITRE Corporation Confidence 100

    [ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • Empire uses
    The MITRE Corporation Confidence 100

    [Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents …

    Published 11/03/2019 15:13 · Modified 27/03/2026 01:07
  • Ping uses
    The MITRE Corporation Confidence 100

    [Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • PoshC2 uses
    The MITRE Corporation Confidence 100

    [PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while …

    Published 23/04/2019 14:31 · Modified 27/03/2026 01:07

Campaign (1)

  • HomeLand Justice attributed-to