Lyceum Group Unveils Stealthy .NET DNS Backdoor in Middle East Campaign

Lyceum, an Iranian state-sponsored threat group, deployed a new .NET-based DNS backdoor called DnsSystem against targets in the Middle East in June 2022. The malware was delivered inside a macro-enabled Word document masquerading as an Iranian military news report. Once the victim opened the document and enabled macros, DnsSystem was installed and began communicating with the attackers via a covert DNS-based channel. Zscaler ThreatLabz documented the campaign and published their findings on June 9, 2022.

The campaign is attributed to Lyceum, also tracked as HEXANE and Spirlin. The group is assessed to operate on behalf of the Iranian government, with a history of targeting oil and gas organizations, telecommunications providers, and government entities across the Middle East and Africa. IOC overlap between this campaign and other Lyceum operations — including shared C2 infrastructure at cyberclub.one — directly links it to the same group.

The primary goal was persistent espionage access. DnsSystem gave the attackers full remote control — command execution, file transfer, process enumeration, and network discovery — while remaining stealthy by using DNS as its communication channel. The Iranian military affairs lure also suggests the group was targeting individuals with access to defense or intelligence-related information. The active security tool detection built into the backdoor indicates awareness of defensive environments and intent to avoid detection.

The campaign targeted organizations and individuals in the Middle East. The specific countries or victim organizations are not named in the Zscaler report, but Lyceum's broader targeting history — Israel, Saudi Arabia, Morocco, Tunisia, and other Middle Eastern and North African states — provides context. The Iranian military affairs lure suggests the intended recipients may have had professional interest in Iranian defense or security topics, potentially including government analysts, defense contractors, or journalists.

DnsSystem is a .NET backdoor built by customizing DIG.net, a legitimate open-source DNS query tool. By starting from an existing DNS library, the group could rapidly develop a functional backdoor while leveraging pre-built DNS functionality. The malware queries an attacker-controlled DNS server and embeds commands in TXT and A record responses — a technique that hides malicious traffic inside a protocol almost universally allowed through corporate firewalls. Commands are Base64-encoded for obfuscation. Supported operations include remote command execution, file upload to and download from the C2, process listing, open application window enumeration, network configuration discovery, and detection of security software.

The attackers sent a phishing email with a macro-enabled Word document (.docm) disguised as an Iranian military affairs news report. Opening the document and enabling macros triggered a VBA macro that dropped and executed the DnsSystem binary. The backdoor then dropped a copy of itself into the Windows Startup folder for persistence across reboots, scanned for running security tools, and began beaconing to news-spot.live (85.206.175.199) via DNS queries. Commands received in DNS responses were decoded and executed, with results transmitted back through the same covert channel.

DnsSystem represents a step forward in Lyceum's tooling. Where earlier Lyceum backdoors (DanBot, Milan, Shark) used a mix of HTTP/S and DNS tunneling, DnsSystem is purpose-built entirely around DNS communication — leveraging a customized version of an existing open-source DNS tool rather than coding DNS handling from scratch. The addition of active security tool detection also shows a growing awareness of endpoint defenses. This evolution is consistent with the group's pattern of iterating their custom toolset every 12–18 months to maintain effectiveness against improving defenses.