'Hexane' Threat Actor Targeting Industrial Organizations

guest · Aug 1, 2019

'Hexane' Threat Actor Targeting Industrial Organizations
August 1, 2019
https://www.securityweek.com/hexane-threat-actor-targeting-industrial-organizations

Referred to as HEXANE and active since at least mid-2018, the actor relies on malicious documents for initial intrusion. These documents drop malware onto the targeted environments to provide attackers with an initial foothold.
The group has become increasingly active in the first half of 2019, targeting oil and gas companies in the Middle East, mainly those in Kuwait.

“By compromising devices, firmware, or telecommunications networks used by targets within ICS, malicious activity could potentially enter the victim environment through a trusted vendor, bypassing much of the entity’s security stack,” Dragos notes in a report shared with SecurityWeek.

HEXANE appears mostly focused on targets in the critical infrastructure, but victimology is divided between ICS verticals and telecommunications operations. The group’s infrastructure and capabilities, including malicious domains and detection evasion schemes, are different from related actors.
At the moment, HEXANE does not appear to have the access or capabilities needed to disrupt ICS networks, Dragos concludes.
Click to expand...

Dragos: New activity group targets oil and gas, telecommunications providers

guest · Aug 27, 2019

Lyceum/Hexane Threat Group Uses Common Hacking Tactics
August 27, 2019
https://www.bleepingcomputer.com/ne...ane-threat-group-uses-common-hacking-tactics/

The Lyceum group first came to public attention at the beginning of the month, when ICS security firm Dragos released a brief report on the activity of this new actor, calling it Hexane.
SecureWorks released today its own report on Lyceum, offering details on the tools and tactics used by the group.

Both security companies agree that the objective of Lyceum/Hexane is to collect information, not to disrupt operations; and while its activity is similar to that of other groups, the malware an infrastructure indicate that there is no relation between them.
Common tactics prove efficient
SecureWorks researchers say that Lyceum relies on password spraying and brute-force attacks to compromise email accounts of individuals working for a targeted organization.
According to the researchers, Lyceum's targets include executives, human resources and IT staff. Individuals in these positions are the recipients of spear-phishing messages delivered from compromised internal accounts.
Click to expand...

guest · Oct 19, 2021

Lyceum APT Returns, This Time Targeting Tunisian Firms
October 19, 2021
https://threatpost.com/lyceum-apt-tunisian-firms/175579/

The Lyceum threat group has resurfaced, this time with a weird variant of a remote-access trojan (RAT) that doesn’t have a way to talk to a command-and-control (C2) server and might instead be a new way to proxy traffic between internal network clusters.

Kaspersky’s Mark Lechtik – senior security researcher at the company’s Global Research & Analysis Team (GReAT) – said in a Monday post that the team has identified a new cluster of Lyceum activity that’s focused on two entities in Tunisia.
Click to expand...

Lyceum has been active since as early as April 2018, when it attacked telecoms, and critical infrastructure in Middle Eastern oil-and-gas organizations. Lyceum treads lightly but carries a big stick: “All the while it has kept a low profile, drawing little attention from security researchers,” the trio of researchers wrote.

The Lyceum group (aka Hexane) was first exposed in 2019 by Secureworks, which spotted the group targeting Middle Eastern energy firms and telecoms with malware-laced spearphishing emails.
Click to expand...

The researchers noted that Lyceum’s modus operandi “bears a striking resemblance to that of APT34/OilRig.”
As well, the macros embedded in documents from the two groups share the same variable names and a similar code structure, as shown below.
Click to expand...

Kaspersky: Lyceum group reborn

Our investigation into Lyceum has shown that the group has evolved its arsenal over the years and shifted its usage from the previously documented .NET malware to new versions, written in C++.

Thus, we observed some of the commands the attackers used within the compromised environments, as well as the actions taken to steal user credentials. These included the use of a PowerShell script designed to steal credentials stored in browsers and a custom keylogger deployed on some of the targeted machines.
Finally, we noticed certain similarities between Lyceum and the infamous DNSpionage group, which, in turn, was associated with the OilRig cluster of activity.
Click to expand...

guest · Nov 9, 2021

Iranian state hackers use upgraded malware in attacks on ISPs, telcos
November 9, 2021
https://www.bleepingcomputer.com/ne...e-upgraded-malware-in-attacks-on-isps-telcos/

The Iranian state-supported APT known as 'Lyceum' (Hexane, Spilrin) targeted ISPs and telecommunication service providers in the Middle East and Africa between July and October 2021.

Apart from Israel, which is permanently in the crosshairs of Iranian hackers, researchers have spotted Lyceum backdoor malware attacks in Morocco, Tunisia, and Saudi Arabia.
In the most recent campaign analyzed in a joint report between researchers at Accenture and Prevailion, Lyceum is seen using two distinct malware families, dubbed Shark and Milan.
Click to expand...

The Shark backdoor is a 32-bit executable written in C# and .NET used to execute commands and exfiltrate data from infected systems.
Milan is a 32-bit remote access trojan (RAT) that can retrieve data from the compromised system and exfiltrate it to hosts derived from domain generation algorithms (DGAs).

According to the technical analysis, which revealed a continual refresh of the beacons and payloads, Lyceum appears to be monitoring researchers who are analyzing their malware to update their code and stay ahead of defensive mechanisms.
Click to expand...

Politically motivated
The particular group of hackers is believed to be politically motivated and exclusively interested in cyber espionage rather than causing operational disruption to their targets.

This is why they focus on ISP network intrusions, as compromising high-level service providers is an excellent way to collect valuable intelligence on foreign nations.

"It is unknown if the Milan backdoor beacons are coming from a customer of the Moroccan telecommunication operator or internal systems within the operator," explains the joint report from Accenture and Prevailion.
Click to expand...

Who are latest targets of cyber group Lyceum?

Findings
The ACTI/PACT team made the following key findings:

Between July and October 2021, Lyceum backdoors appear to have targeted ISPs and telecommunication operators in Israel, Morocco, Tunisia, and Saudi Arabia as well as a ministry of foreign affairs (MFA) in Africa.

At least two of the identified compromises are assessed to be ongoing despite prior public disclosure of indicators of compromise (IOCs).

Domain name system (DNS) tunneling appears to be used only during the early stages of backdoor deployment; subsequently, the Lyceum operators use the HTTP(S) command and control (C2) functionality encoded in the backdoors.

Click to expand...

Log in or Sign up

'Hexane' Threat Actor Targeting Industrial Organizations

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

'Hexane' Threat Actor Targeting Industrial Organizations

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches