HEXANE

Executive Summary

HEXANE, an unspecified cyber threat actor also known as Lyceum, Siamesekitten, and others, primarily engages in espionage activities targeting critical sectors such as government, energy, telecommunications, education, and defense across the Middle East and Africa. The group has been active since at least 2017, employing sophisticated tactics including keylogging, credential theft, and data exfiltration through various tools and techniques.

Goals & Targeting

HEXANE's primary motivation appears to be espionage, with strategic objectives likely aimed at gathering intelligence from critical infrastructure sectors, government entities, and defense organizations in the Middle East and Africa. The group targets specific industries to acquire sensitive data that could provide a competitive or strategic advantage to its backers, possibly nation-state sponsors given the sophistication of operations and prolonged targeting of critical sectors.

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations primarily in the Middle East and Africa, including countries such as Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. The group's activities have been noted since at least 2017, with campaigns observed by multiple security firms including Dragos, Kaspersky, ClearSky, and Accenture. HEXANE's TTPs are similar to other advanced persistent threat (APT) groups such as APT33 and OilRig but due to differences in victimology and tools used, it is tracked as a distinct entity. The group primarily focuses on espionage objectives, aiming to gather sensitive information from targeted sectors.

Key Capabilities

• espionage
• cyber-espionage
• sophisticated APT tactics
• credential theft
• data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

HEXANE has conducted multiple campaigns targeting Middle Eastern countries, including Israel, Saudi Arabia, and others. The group's operations demonstrate a focus on critical infrastructure sectors and government entities, with campaigns noted by Dragos, Kaspersky, ClearSky, and Accenture. Notable past operations include attacks against oil & gas companies and telecommunications providers.

IOC Patterns

• Scheduled Task
• Keylogging
• Internet Connection Discovery
• DNS Server Queries
• Malicious Files
• Email Account Compromise
• Credentials from Password Stores
• Web Browser Credentials Stealing

Recommended Actions

• Implement endpoint detection and response (EDR) solutions to monitor for known HEXANE TTPs.
• Conduct regular network monitoring for异常 DNS queries and unusual data exfiltration patterns.
• Enforce multi-factor authentication across critical systems to mitigate potential brute force or password spraying attempts.
• Patch and update software promptly to address vulnerabilities targeted by APT groups.
• Educate employees about phishing tactics, especially spear-phishing emails that HEXANE may employ.

Suggested Tags