Actors Insights|Latest update04/07/2026

Lyceum

Named by SecureWorksSuspected state sponsor: Islamic Republic of Iran

Lyceum is an Iranian state-linked threat cluster active since at least 2018, targeting oil and gas companies, telecommunications providers, and government organizations across the Middle East and Africa. The group uses credential spraying against personal email accounts as an initial access method before pivoting to corporate networks, and deploys custom .NET malware families including DanBot, Shark, and Milan for persistent access. Lyceum is tracked as HEXANE by Secureworks and SiameseKitten by Israeli researchers, all referring to the same cluster focused on regional energy and telecommunications intelligence collection.

First Seen:Apr 2018
Last Seen:Jun 2022
Indexed Reports:8
Public IOCs:218
Cluster: LyceumMitre: HEXANEMisp: LYCEUM
also known as:
COBALT LYCEUM (SecureWorks)Hexane (Dragos)UNC1530 (Mandiant)SpirlinMYSTICDOMESiameseKitten (ClearSky)Chrono Kitten (CrowdStrike)Storm-0133 (Microsoft)COBALT LYCEUM (SecureWorks)G1001 (Mitre)

Targeted Regions

Israel
IL
Israel
Israel
Jul 2021 ~ Nov 2021
Jul 2021 ~ Nov 2021
Mar 2022 ~ Mar 2022
Middle East
ME
Middle East
Middle East
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
May 2019 ~ Aug 2019
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
May 2019 ~ Aug 2019
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Jan 2020 ~ Jan 2020
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2020
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Jun 2022 ~ Jun 2022
Morocco
MA
Morocco
Morocco
Jul 2021 ~ Nov 2021
Jul 2021 ~ Nov 2021
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jul 2021 ~ Nov 2021
Jul 2021 ~ Nov 2021
Mar 2022 ~ Mar 2022
South Africa
ZA
South Africa
South Africa
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Tunisia
TN
Tunisia
Tunisia
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Apr 2018 ~ Oct 2021
Jul 2021 ~ Nov 2021
Apr 2018 ~ Oct 2021
Jul 2021 ~ Nov 2021
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jun 2022 ~ Jun 2022
Jan 2018Aug 2026

Targeted Sectors

TelecommunicationUtilitiesOil and GasInformation TechnologyAerospaceEnergyGovernment Agencies and Services

Recent Indexed Reports

  1. Public
    Iranian Lyceum Group Deploys Malware Disguised as Adobe Update
  2. Public
    Lyceum Group Unveils Stealthy .NET DNS Backdoor in Middle East Campaign
  3. Public
    Lyceum's Multi-Dropper Cyber Attack Targets Israeli and Saudi Entities
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.