HEXANE

G10012 reports

aliases · HEXANE · Lyceum · Siamesekitten · Spirlin

Reports

Techniques

Tactics

Countries

62%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1588.006 (Vulnerabilities), T1589.001 (Credentials), T1069.001 (Local Groups).
Primary targeting: IR, US, IL, AE.
Steady activity: 0 report(s) in last 30d vs 0 prior (+0%).
Hunt coverage 62% of 13 observed techniques (5 gap(s)).
Assessment confidence: medium (61).

Activity & trend

SteadyLast 30d: 0 vs 0 prior (+0%)· first reported 2026-07-06 · last 2026-07-21

30d

90d

All

0.2

Rpts/wk

Reporting timeline · 12 months

Overview

Analyst triage

Intelligence summary

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1588.006 · Vulnerabilitiesconf 652
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1589.001 · Credentialsconf 652
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1069.001 · Local Groupsconf 601
evidence: Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1027.003 · Steganographyconf 601
evidence: Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1001.002 · Steganographyconf 601
evidence: Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1204.002 · Malicious Fileconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1574.014 · AppDomainManagerconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1684 · Social Engineeringconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1491 · Defacementconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1087.004 · Cloud Accountconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1136.003 · Cloud Accountconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1684.001 · Impersonationconf 601
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected