MITRE ATT&CKgroup

G1001 HEXANE

Published 2018-10-17 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
Lyceum, Siamesekitten, Spirlin
Version
2.3
Created
2018-10-17

Description

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

Related

Uses · MITRE ATT&CK (48)

  • T1027.010 Command Obfuscation sub-technique
  • S1021 DnsSystem software (malware)
  • S1020 Kevin software (malware)
  • S1019 Shark software (malware)
  • S1015 Milan software (malware)
  • S1014 DanBot software (malware)
  • T1016.001 Internet Connection Discovery sub-technique
  • T1608.001 Upload Malware sub-technique
  • T1589 Gather Victim Identity Information technique
  • T1589.002 Email Addresses sub-technique
  • T1591.004 Identify Roles sub-technique
  • T1583.002 DNS Server sub-technique
  • T1585.001 Social Media Accounts sub-technique
  • T1585.002 Email Accounts sub-technique
  • T1586.002 Email Accounts sub-technique
  • T1588.002 Tool sub-technique
  • T1583.001 Domains sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1069.001 Local Groups sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1056.001 Keylogging sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1555 Credentials from Password Stores technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1053.005 Scheduled Task sub-technique
Show all 48 ›

References