HEXANE Targets Middle Eastern Oil and Gas and Telecoms with Sophisticated Techniques
- Attack Vectors: Dropper
- Attack Complexity: Medium
- Threat Risk: Unknown
Threat Overview
Dragos, a cybersecurity firm specialising in industrial control systems (ICS), has identified a new threat group, HEXANE, active since 2018. Primarily targeting oil and gas companies in the Middle East, HEXANE unusually also targets telecommunications providers across a wider region, potentially as a means to access ICS networks. While sharing some similarities with other ICS-focused groups like MAGNALLIUM and CHRYSENE, HEXANE's unique victimology and tactics distinguish it. Currently, Dragos assesses HEXANE as lacking the capability to directly disrupt ICS operations, though further details are available in their subscription-based threat intelligence reports. The report highlights the increasing trend of adversaries targeting third-party organisations in supply chains.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Oil and Gas | High |
| Sector | Telecommunication | High |
| Region | Kuwait | High |
FAQs
HEXANE: targeting, methods and known limits
Dragos describes attacks on oil and gas companies and telecommunications providers. Malicious documents drop malware to give the attackers a foothold for further activity. The source focuses on access to IT networks associated with industrial organizations.
Dragos tracks HEXANE as a distinct group because its tools, behavior and targets differ. The report describes similarities with MAGNALLIUM and CHRYSENE, which do not establish that they are the same actor. This source does not assign HEXANE a nationality.
Oil and gas targeting focused on the Middle East, with Kuwait identified as a primary region. Telecommunications targeting extended across the Middle East, Central Asia and Africa. The group appears to have operated since at least mid-2018, with activity accelerating in early to mid-2019; the public profile names no individual victims.
Dragos assesses that access through telecommunications providers could help attackers reach other organizations through trusted connections. This is a potential path toward industrial targets, rather than proof that every intended downstream target was compromised. The public source does not establish the ultimate objective of each intrusion.
The report does not establish a disruption of industrial control systems. At the time of its assessment, Dragos judged with moderate confidence that HEXANE lacked the access and capability to disrupt those networks. That assessment does not prove the group could never develop such capabilities.
The report describes malicious Excel files, malware communications through common internet protocols, and techniques intended to evade detection. It gives no specific defensive actions in the public profile. Dragos states that more detailed technical reporting and defensive strategies are available to its subscribers.