Lyceum APT Targets Middle Eastern Oil, Gas, and Telecom Sectors
- Actor Motivations: Exfiltration
- Attack Vectors: Malicious Macro,Malware,RAT
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
The Lyceum APT targets the oil, gas and telecommunications sectors in the Middle East, focusing on credential theft and network infiltration through a multi-stage attack chain. The initial infection involves malicious Microsoft Office documents that deploy DanDrop, a VBA-based malware dropper that installs DanBot, a remote access Trojan used for ongoing control. The group also uses PowerShell scripts, including keyloggers and credential decryption tools, to gather sensitive data from Active Directory and RDCMan configurations. The sophisticated attack chain used by this cybercrime group highlights the ongoing threat to critical infrastructure in the Middle East.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Oil and Gas | Verified |
| Sector | Telecommunication | Verified |
| Region | Middle East Countries | Verified |
About Affiliation
Lyceum
Lyceum is an Iranian state-linked threat cluster active since at least 2018, targeting oil and gas companies, telecommunications providers, and government organizations across the Middle East and Africa. The group uses credential spraying against personal email accounts as an initial access method before pivoting to corporate networks, and deploys custom .NET malware families including DanBot, Shark, and Milan for persistent access. Lyceum is tracked as HEXANE by Secureworks and SiameseKitten by Israeli researchers, all referring to the same cluster focused on regional energy and telecommunications intelligence collection.
View Lyceum's Insights