lyceum

Executive Summary

Lyceum, a name used by multiple Iranian APT groups (HEXANE, HOPE), is executing focused espionage against Israeli and broader Middle Eastern government, energy, telecom, defense, and education entities. The group employs a sophisticated .NET DNS backdoor that hijacks DNS traffic and Microsoft Graph API to establish covert command‑and‑control channels, encrypting communications with hybrid RSA/AES-256-GCM and staging exfiltrated data on local hosts before transmission.

Goals & Targeting

Lyceum’s strategic remit appears to revolve around gathering covert intelligence on Middle Eastern critical infrastructure. By focusing on Israel and neighboring states, they likely target high‑value government agencies, energy operators, telecommunications providers, defense contractors and educational institutions. The attacker compiles data ranging from system logs and configuration files to encrypted documents, then exfiltrates it via the same hidden C&C channels that maintain persistence.

Key Capabilities

• DNS hijacking and hijacked backdoor control
• .NET-based malware deployment (Lyceum.NET DNS Backdoor)
• Command & Control over TXT, A, AAAA records
• Microsoft Graph API exploitation for covert C&C
• Encrypted hybrid RSA/AES-256-GCM communications
• Data staging in local directories prior to exfiltration (T1074)
• Command obfuscation using junk data and Base64 encoding (T1001.001)
• Masquerading legitimate utilities via renaming (T1036.003)
• Credential dumping with Mimikatz and winlogon logs
• Brute‑force / password‑spraying across local & domain accounts
• Persistence via Startup folder, Registry Run Keys, WMI events, Scheduled Tasks
• Privilege escalation via UAC bypass, SID‑History injection, Pass the Hash
• Lateral movement via RDP, SMB relay, remote shell execution
• Supply chain attack potential and exploitation of Microsoft Exchange CVE‑2021‑26855

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

During the most recent campaign (June–July 2026) Lyceum infected at least twelve distinct endpoints across Iranian and Israeli infrastructures, though only three remained active at detection time. The attacks followed a disciplined operational tempo: initial infiltration via macro or Exchange vulnerability, deployment of the .NET backdoor, staging of data in hidden directories (often under the "AppData\Roaming" folder), then exfiltration through either DNS TLD queries or Microsoft Graph calendar events dated in the far future. Victims have consistently been governmental ministries, energy companies, and telecom operators with high-value control systems or policy content.

IOC Patterns

• DNS hijacking patterns
• Backdoor traffic over DNS
• Suspicious .NET executable signatures
• Unusual DNS query volumes to external domains
• Custom TXT record command delivery
• Base64‑encoded payloads in DNS A records
• Encrypted calendar attachments via Microsoft Graph API
• Renamed legitimate system utilities for masquerading
• Central staging directories before exfiltration
• Use of IPv6 AAAA records for credential refresh

Recommended Actions

• Implement DNS anomaly detection and block known malicious domains such as "cyberclub.one".
• Deploy endpoint protection that prevents execution of unsigned or unknown .NET binaries.
• Enable application whitelisting, particularly blocking Office documents containing macros unless verified.
• Monitor for unusual HTTP requests to Microsoft Graph API endpoints with calendar events dated well beyond current date.
• Enforce multi‑factor authentication and restrict privilege escalation paths (UAC, SID‑History injection).
• Configure log collection to flag large file staging directories and suspicious PowerShell executions.
• Block outbound DNS TXT/A queries carrying Base64 payloads or other obfuscated data.
• Perform threat hunting for hidden processes that use dig.net resolver utilities.
• Apply rapid patching of Microsoft Exchange servers, especially CVE‑2021‑26855 (Appcmd.exe).
• Deploy a robust DLP solution that detects sensitive documents exported via OneDrive or similar cloud services.

Suggested Tags