Lyceum Cluster

Lyceum is an Iranian state-linked threat cluster active since at least 2018, focused on cyber espionage against organizations in the oil and gas, telecommunications, and government sectors across the Middle East and Africa. The group was first publicly documented by researchers at Secureworks, MITRE, and Kaspersky and is assessed to operate in support of Iranian state interests.

Targets and Goals

Lyceum's primary targets are energy companies — particularly oil and gas operators — and telecommunications providers in the Middle East, with documented intrusions in Saudi Arabia, Kuwait, Morocco, Tunisia, and Israel. The focus on energy and telecommunications reflects strategic intelligence requirements typical of Iranian state espionage, providing insights into regional energy production and enabling potential interception of communications.

Tooling and Tactics

Lyceum uses credential stuffing and password spraying for initial access, targeting known personal email accounts of employees at organizations of interest before pivoting to corporate systems. The group delivers custom .NET-based malware including DanBot (a remote access trojan using DNS and HTTP for C2), Shark, and Milan — both backdoors identified in later operations. Lyceum has also used macro-enabled Excel documents and PowerShell scripts for delivery and post-compromise activity. A distinctive operational characteristic is the group's patience in building access through personal accounts before moving into corporate environments.

Aliases

Lyceum is tracked as HEXANE by Secureworks and SiameseKitten by Israeli cybersecurity researchers. All three names describe the same Iranian-linked cluster with overlapping infrastructure and targeting.