Hexane

HEXANE is Secureworks' designation for the Iranian threat cluster known as Lyceum. Active since at least 2018, the group targets oil and gas and telecommunications organizations in the Middle East and Africa using credential spraying, spear phishing, and custom malware including the DanBot remote access trojan. Secureworks first documented HEXANE in 2019, highlighting its focus on upstream energy companies and ISPs — a targeting profile consistent with Iranian state intelligence requirements for monitoring regional energy flows and communications infrastructure.