Lyceum's Multi-Dropper Cyber Attack Targets Israeli and Saudi Entities

Lyceum, an Iranian-linked APT group, launched a spearphishing campaign in March 2022 that used the Russia-Ukraine war as a lure to target an Israeli energy company and entities in Saudi Arabia. Victims received emails with links to malicious documents hosted on attacker-controlled infrastructure. The documents displayed legitimate-looking news articles as decoys while silently installing one of three custom backdoors. Check Point Research published the analysis on March 31, 2022, as part of a broader report on APT groups exploiting the conflict.

The campaign is attributed to Lyceum, an Iranian state-sponsored threat group also tracked as HEXANE and Spirlin. Check Point confirmed attribution through multiple indicators: reuse of the Heijden.DNS open-source library consistent with earlier Lyceum campaigns, DNS tunneling C2 architecture, infrastructure overlap with known Lyceum C2 servers on the same ASN, and Protonmail addresses used both to send phishing emails and register the campaign domains — a pattern observed consistently across Lyceum operations.

The goal was cyber espionage — establishing persistent access to energy sector organizations in Israel and Saudi Arabia to collect intelligence of strategic value to Iran. All three backdoors support command execution, file upload and download, and system reconnaissance, consistent with a sustained intelligence collection mission. The use of three different backdoor families with different C2 protocols also suggests the group was testing and diversifying its toolset while maintaining operational resilience.

The campaign primarily targeted an Israeli energy company and entities in Saudi Arabia. Artifacts uploaded to VirusTotal from Saudi Arabia during the same period confirm the regional scope. Decoy documents found on the campaign infrastructure included materials themed around the Russia-Ukraine war, Russian nuclear weapons, and a Ukraine-based job posting — suggesting the lures were crafted for recipients with professional interest in geopolitical and security topics, likely employees at energy and defense-adjacent organizations.

Israeli and Saudi energy organizations hold direct strategic intelligence value for Iran. Israel is Iran's primary regional adversary, and its energy infrastructure and industrial capabilities are of significant interest. Saudi Arabia controls major oil production that competes directly with Iran's economic interests. Lyceum's consistent focus on energy sectors in both countries — dating back to 2018 — reflects a sustained mandate to collect intelligence on these industries. The Russia-Ukraine war lure was effective because energy sector professionals in the Middle East were actively monitoring the conflict's impact on global oil markets.

Lyceum used three parallel attack chains in this campaign. In the first, a spearphishing email linked to a malicious Office document that ran a macro when closed — dropping a payload into the Windows Startup folder for next-reboot execution. In the second and third chains, executable droppers disguised with PDF icons opened a decoy PDF for the victim while silently downloading and installing one of three backdoors: a .NET DNS backdoor (DNS tunneling via modified DnsDig/Heijden.DNS), a .NET TCP backdoor (raw TCP sockets with custom protocol), or a Golang HTTP backdoor (three-stage HTTP POST loop to /GO/1.php, /GO/2.php, /GO/3.php). All three backdoors support command execution, file upload/download, and system reconnaissance. The Golang backdoor also generates a victim ID from an MD5 hash of the username for C2 registration.

The deployment of three separate backdoor families with three different C2 protocols — DNS tunneling, raw TCP sockets, and HTTP POST — is a significant evolution for Lyceum. Earlier campaigns used one or two C2 channels per implant. This multi-dropper approach gives the group flexibility: if one backdoor or C2 channel is detected and blocked, the others remain active. The Golang backdoor is also a new language addition to Lyceum's previously .NET-focused toolkit, reflecting investment in cross-platform capability development. The decoy-on-close macro technique (payload executes when the document is closed rather than opened) is also a evasion refinement not seen in earlier Lyceum campaigns.