LYCEUM's Multi-Faceted DanBot Malware Targets Oil and Gas Sector

LYCEUM, an Iranian-linked threat group also known as HEXANE, deployed DanBot — a custom C#/.NET Remote Access Trojan — against oil and gas organizations in the Middle East. The malware was delivered via spearphishing emails containing malicious Excel files. Once installed, DanBot gave attackers persistent remote access and communicated with their command-and-control servers over both DNS tunneling and HTTP/S channels. CyberX published its deep technical analysis of DanBot's architecture in January 2020.

The campaign is attributed to LYCEUM, also tracked as HEXANE and Spirlin. The group is assessed to be Iranian state-sponsored based on its targeting patterns — consistently focused on oil and gas organizations and telecommunications providers in countries of strategic interest to Iran, including Middle Eastern and African targets. ESET's later research linked LYCEUM to OilRig (APT34) as a subgroup.

The primary goal was intelligence collection and persistent access within oil and gas sector networks. DanBot's capabilities — remote command execution, file upload and download, and system profiling — are consistent with a sustained espionage mission rather than a disruptive or financially motivated attack. LYCEUM's focus on energy organizations with ties to Middle Eastern petrochemical production aligns with Iran's interest in monitoring rivals' energy sector operations and capabilities.

The campaign targeted oil and gas organizations in the Middle East. While the report does not name specific victim countries or companies, indicators in DanBot samples (including Arabic-language naming conventions) and IOC overlap with other LYCEUM campaigns that targeted Saudi Arabia and other Gulf states suggest a consistent Middle Eastern focus. The 5 documented C2 domains also overlap with domains used in a contemporaneous Secureworks campaign targeting Saudi-region energy targets.

Oil and gas companies hold proprietary data on production volumes, reserves, infrastructure, contracts, and industrial control systems — all of high intelligence value to a state-sponsored actor seeking to monitor or disrupt rivals' energy sectors. Middle Eastern energy organizations are of particular interest to Iran because their output, pricing, and infrastructure decisions directly affect Iran's own energy revenues and regional influence. DanBot's long campaign life (2018–2021+) reflects the sustained nature of LYCEUM's interest in this sector.

LYCEUM delivered spearphishing emails with malicious Excel (.XLS) attachments. Opening the file and enabling macros triggered DanDrop, a VBA macro that extracted the DanBot payload, Base64-decoded it, and installed it via a Windows scheduled task. DanBot then began beaconing to its C2 servers using two independent channels: DNS tunneling — built on a repurposed version of the open-source Heijden.Dns library — and direct HTTP/S requests. Both channels supported command execution and file transfer. C2 traffic was encrypted using symmetric encryption and Base64-encoded. Encrypted configuration files stored on disk held DanBot's operational settings between reboots.

DanBot's dual C2 design — DNS tunneling plus HTTP/S — gives it a meaningful detection evasion advantage. DNS is allowed through most corporate firewalls as a required protocol, and DNS tunneling is harder to detect than direct HTTP/S connections to known malicious IPs. By maintaining two independent channels, DanBot also ensures the group retains access even if one protocol is blocked. The repurposing of the legitimate Heijden.Dns open-source library for tunneling further reduces the chance of signature-based detection, since parts of the code are shared with a benign library.