Lyceum's Cyber Espionage Campaign Targets Telecoms and ISPs in the Middle East and Africa

Lyceum, an Iranian-linked threat group also known as HEXANE and Spirlin, targeted telecommunications providers and internet service providers (ISPs) in Israel, Morocco, Tunisia, and Saudi Arabia between July and November 2021. A Ministry of Foreign Affairs in an unnamed African country was also compromised. The group deployed two custom backdoors — Shark and Milan — to maintain persistent access and collect intelligence from these strategic communications networks. Prevailion and Accenture jointly documented the campaign in November 2021.

The campaign is attributed to Lyceum, an Iranian state-sponsored threat group. The group is also tracked as HEXANE by Dragos and Spirlin by other researchers. ESET's subsequent analysis linked Lyceum and SiameseKitten to OilRig (APT34) as a subgroup. Lyceum has been active since at least 2018, with earlier campaigns documented by Secureworks targeting oil and gas organizations in the Middle East and South Africa.

The primary goal was intelligence collection from telecommunications infrastructure. Telecom providers and ISPs have access to vast amounts of communications data — call records, subscriber information, internet traffic metadata, and routing infrastructure — all of which are highly valuable to a state-sponsored actor seeking to monitor individuals or conduct signals intelligence. The Ministry of Foreign Affairs compromise also suggests a diplomatic intelligence collection mission running in parallel.

The campaign hit four countries — Israel, Morocco, Tunisia, and Saudi Arabia — plus an unnamed African country where a Ministry of Foreign Affairs was compromised. The focus on Israel fits Lyceum's broader pattern of targeting Iranian rivals. Morocco, Tunisia, and Saudi Arabia are also strategically important to Iranian intelligence given their regional geopolitical roles and connections. The unnamed African MFA compromise suggests Lyceum's reach extends beyond the Middle East into Africa.

The campaign focused specifically on telecommunications providers and internet service providers — organizations that control the backbone of national communications infrastructure. A government ministry (Foreign Affairs) was also targeted, consistent with diplomatic intelligence collection. Telecom and ISP staff with access to network management systems, subscriber databases, and routing configurations were likely the primary targets within victim organizations.

Lyceum used two backdoors with different C2 channels. Shark communicated over HTTPS, blending traffic with normal web activity. Milan used DNS tunneling, hiding commands inside DNS queries — a method that often evades network monitoring focused on HTTP/S traffic. Both backdoors supported command execution, file upload and download, and system reconnaissance. Persistence was maintained via Windows scheduled tasks, and C2 traffic was XOR-encoded to hinder detection. The group registered 26 C2 domains with security and Windows-update-themed names to appear legitimate.

Telecom providers and ISPs are among the most sensitive targets for state-sponsored espionage — they sit at the center of national communications and can provide access to call records, subscriber data, internet traffic, and routing tables. For Iran, access to telecom infrastructure in Israel, Saudi Arabia, and North Africa provides intelligence on adversaries' communications without needing to compromise individual targets. A Ministry of Foreign Affairs similarly holds diplomatic correspondence, classified cables, and details of foreign policy negotiations.