LYCEUM's Cyber Campaign on Middle Eastern Sectors: An In-depth Analysis

LYCEUM, an Iranian-linked threat group also tracked as HEXANE, launched a campaign against oil and gas organizations in the Middle East starting in May 2019. The group first compromised employee email accounts via password spraying, then used those accounts to send phishing emails with malicious Excel files to executives, HR, and IT staff. The Excel files silently installed a custom remote access trojan called DanBot, which gave attackers persistent access and the ability to move laterally within victim networks. Secureworks CTU published its foundational analysis of LYCEUM in August 2019.

The campaign is attributed to LYCEUM, also known as HEXANE. At the time Secureworks published this report, there was insufficient technical evidence to definitively link LYCEUM to a specific nation-state sponsor, though the group's tradecraft resembled that of known Iranian groups — particularly OilRig/APT34 (COBALT GYPSY) and Elfin/APT33 (COBALT TRINITY). Subsequent reporting and ESET's later analysis linked LYCEUM and Siamesekitten to OilRig as a subgroup.

The primary goal was establishing and expanding access within targeted networks for intelligence collection. LYCEUM focused on obtaining credentials from executives, HR staff, and IT personnel — roles that collectively provide broad network access, sensitive organizational data, and administrative privileges. The group deployed a keylogger, an RDP credential decryptor, and an Active Directory enumeration tool, suggesting a methodical effort to map and escalate access within the target environment rather than a one-time smash-and-grab operation.

The May 2019 campaign targeted oil and gas organizations in the Middle East. Earlier 2018 activity targeted organizations in South Africa using similar tooling. Secureworks warned that future targeting should not be assumed to be limited to the energy sector — telecommunications and other critical infrastructure organizations in the region were also considered at risk based on the group's broader profile.

LYCEUM targeted oil and gas organizations in the Middle East, with a specific focus on employees in executive, HR, and IT roles. These roles were chosen deliberately: executives have access to sensitive business decisions, HR personnel hold account data useful for further phishing operations, and IT staff have access to privileged accounts and network documentation. The group's lures included training schedules and security best practice documents designed to appear legitimate to these specific audiences.

LYCEUM began by spraying common passwords across many employee email accounts to avoid triggering lockout policies. Once an account was compromised, the attackers sent phishing emails from that internal address — significantly increasing the chance of the recipient opening the attachment. The malicious Excel file contained a VBA macro (DanDrop) that silently extracted and installed DanBot via a Windows scheduled task. DanBot then communicated with LYCEUM's C2 servers over both DNS and HTTP, and within about an hour, the attackers deployed additional tools: a PowerShell keylogger (kl.ps1) to capture passwords typed by users, a PoshC2-based tool to decrypt stored RDP credentials (Decrypt-RDCMan.ps1), and an Active Directory enumeration script (Get-LAPSP.ps1) to map user accounts and group memberships across the environment.

Middle Eastern oil and gas organizations hold strategic intelligence value for Iran — their production volumes, contracts, pricing, and infrastructure details are directly relevant to Iran's energy sector competition with Gulf states. The group's consistent focus on HR and IT roles also suggests a supply chain angle: compromising these personnel can yield access credentials and contact lists that enable further attacks on partner organizations. South Africa's energy sector was targeted in 2018, suggesting LYCEUM also has interest in African energy infrastructure connected to the Middle East.