Threat Actor Characterization
HEXANE
ID: e6ea19f150a5ce15ecdae0c9b4a974c188409| Lyceum | Siamesekitten | Sp***** | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
HEXANE (a.k.a. Lyceum/Siamesekitten/Spirlin) — espionage actor since 2017 targeting oil & gas, telecom, aviation, and ISPs in MENA; techniques span SharePoint exploitation (CVE-2019-0604), Exchange mailbox targeting, PowerShell/WMI, DNS TXT C2, and in the HomeLand Justice campaign, ROADSWEEP ransomware and ZeroCleare wiping.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1134.001 | Token Impersonation/Theft | TA0004 TA0005 |
|
| T1098.002 | Additional Email Delegate Permissions | TA0003 TA0004 |
|
| T1059.001 | PowerShell | TA0002 |
|
| T1583.002 | DNS Server | TA0042 |
|
| T1562.001 | Disable or Modify Tools | TA0005 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
| T1561.002 | Disk Structure Wipe | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
HEXANE is a cyber-espionage actor active since at least 2017, repeatedly targeting oil & gas, telecommunications, aviation, and ISP organizations across the Middle East and North Africa (Israel, Saudi Arabia, Kuwait, Morocco, Tunisia). While its TTPs partially resemble APT33 and OilRig, HEXANE’s victimology and tooling justify tracking it as a distinct cluster. Recent activity mapped by MITRE includes email account takeover in Microsoft Exchange, token impersonation, SharePoint exploitation (CVE-2019-0604), PowerShell/VBScript tooling, DNS-based C2, EDR tampering, and in the HomeLand Justice campaign, ROADSWEEP ransomware and ZeroCleare wiping for impact. Confidence: high on targeting/TTPs; medium on any one-to-one overlap with other Iran-nexus sets.
Open sources and sector targeting strongly suggest an Iran-aligned intelligence objective set (energy/telecom situational awareness). However, vendors separate HEXANE from APT33/OilRig due to differences in toolchains and targets. INFERENCE (state nexus: medium confidence).