HEXANE
- ID
- G1001
- Associated names
- Lyceum, Siamesekitten, Spirlin
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]
Techniques used (36)
- T1010 Application Window Discovery
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1027.010 Command Obfuscation
- T1033 System Owner/User Discovery
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1069.001 Local Groups
- T1082 System Information Discovery
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1110.003 Password Spraying
- T1204.002 Malicious File
- T1518 Software Discovery
- T1534 Internal Spearphishing
- T1546.003 Windows Management Instrumentation Event Subscription
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1567.002 Exfiltration to Cloud Storage
- T1583.001 Domains
- T1583.002 DNS Server
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1591.004 Identify Roles
- T1608.001 Upload Malware
Software used (12)
- S0002 Mimikatz
- S0097 Ping
- S0100 ipconfig
- S0104 netstat
- S0190 BITSAdmin
- S0363 Empire
- S0378 PoshC2
- S1014 DanBot
- S1015 Milan
- S1019 Shark
- S1020 Kevin
- S1021 DnsSystem