Início / Grupos de ameaça / HEXANE

HEXANE G1001

🔔 Criar alerta

Também conhecido como: Lyceum, Siamesekitten, Spirlin

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

40

Técnicas

12

Malwares e ferramentas

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1589.002 Email Addresses T1591.004 Identify Roles

Desenvolvimento de recursos

T1583.001 Domains T1583.002 DNS Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool T1608.001 Upload Malware

Execução

T1053.005 Scheduled Task T1059.001 PowerShell T1059.005 Visual Basic T1204.002 Malicious File

Persistência

T1053.005 Scheduled Task T1546.003 Windows Management Instrumentation Event Subscription

Escalada de privilégios

T1053.005 Scheduled Task T1546.003 Windows Management Instrumentation Event Subscription

Furtividade

T1027.010 Command Obfuscation

Acesso a credenciais

T1056.001 Keylogging T1110 Brute Force T1110.003 Password Spraying T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers

Descoberta

T1010 Application Window Discovery T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1082 System Information Discovery T1518 Software Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1534 Internal Spearphishing

Coleta

T1056.001 Keylogging

Comando e controle

T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer

Exfiltração

T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

DanBotMalwareS1014
DnsSystemMalwareS1021
KevinMalwareS1020
MilanMalwareS1015
SharkMalwareS1019
BITSAdminFerramentaS0190
EmpireFerramentaS0363
ipconfigFerramentaS0100
MimikatzFerramentaS0002
netstatFerramentaS0104
PingFerramentaS0097
PoshC2FerramentaS0378

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.