CVE Intelligence
Home / Threat actors / HEXANE

HEXANE G1001

🔔 Create alert

Also known as: Lyceum, Siamesekitten, Spirlin

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
40
Techniques
12
Malware and tools

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1589 Gather Victim Identity InformationT1589.002 Email AddressesT1591.004 Identify Roles
Resource Development
T1583.001 DomainsT1583.002 DNS ServerT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.002 Email AccountsT1588.002 ToolT1608.001 Upload Malware
Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1204.002 Malicious File
Persistence
T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription
Privilege Escalation
T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription
Stealth
T1027.010 Command Obfuscation
Credential Access
T1056.001 KeyloggingT1110 Brute ForceT1110.003 Password SprayingT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Discovery
T1010 Application Window DiscoveryT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.001 Local GroupsT1082 System Information DiscoveryT1518 Software Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1534 Internal Spearphishing
Collection
T1056.001 Keylogging
Command and Control
T1102.002 Bidirectional CommunicationT1105 Ingress Tool Transfer
Exfiltration
T1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.