Inside Hexane: Sophisticated Cyber Tools and Tactics Targeting Critical Industries
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Keylogger,Malware
- Attack Complexity: Medium
- Threat Risk: High Impact/Low Probability
Threat Overview
Hexane (LYCEUM), a threat actor primarily targeting the Middle East’s oil, gas, and telecommunications sectors, has expanded its attack methods. Using spear-phishing emails with malicious Excel macros, the group delivers DanBot, a RAT capable of DNS and HTTP-based command and control, file transfer, and command execution. Additional tools include a PowerShell-based keylogger, credential decryption scripts, and LDAP data-extraction tools targeting Active Directory accounts. They employ social engineering, password spraying, and DNS tunneling to maintain access, frequently rotating C2 infrastructure. The group’s activity indicates continued cyber threats within these critical sectors.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Information Technology | Verified |
| Sector | Oil and Gas | Verified |
| Sector | Telecommunication | Verified |
| Region | Middle East Countries | Verified |
About Affiliation
Hexane
HEXANE is Secureworks' designation for the Iranian threat cluster known as Lyceum. Active since at least 2018, the group targets oil and gas and telecommunications organizations in the Middle East and Africa using credential spraying, spear phishing, and custom malware including the DanBot remote access trojan. Secureworks first documented HEXANE in 2019, highlighting its focus on upstream energy companies and ISPs — a targeting profile consistent with Iranian state intelligence requirements for monitoring regional energy flows and communications infrastructure.
View Hexane's Insights