- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- Iran (Islamic Republic of)
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G1001 · 36 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0126 · hexane
IranWhat it is
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Chrono Kitten
- Mandiant
- UNC1530
- Microsoft
- Storm-0133
- MITRE ATT&CK
- G1001
- Operations
- Operation “Out to Sea”
- Other names
- LYCEUM, ATK 120, Cobalt Lyceum, MYSTICDOME, Siamesekitten, Spirlin, Yellow Dev 9
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Israel, Kuwait, Middle East, Morocco, Saudi Arabia, Tunisia, United Arab Emirates
- Sectors
- Defense, Education, Energy, Government, High-Tech, Military, Oil and gas, Telecomms, Telecommunications
Tools
The tools and malware families the sources tie to it.
- BITSAdmin
- Cyber Eye RAT
- CyberGate
- DanBot
- DnsSystem
- Empire
- Kevin
- Milan
- Mimikatz
- Ping
- PoshC2
- SharK
- Shark
- ipconfig
- netstat
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de