FORENSIA

THREAT_ACTOR · G1001

HEXANE

Also known as: HEXANE, Lyceum, Siamesekitten, Spirlin

Profile

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

MITRE ATT&CK ↗

Techniques

36 ATT&CK techniques attributed to this actor.

T1010 Application Window DiscoveryT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1027.010 Command ObfuscationT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1056.001 KeyloggingT1057 Process DiscoveryT1059.001 PowerShellT1059.005 Visual BasicT1069.001 Local GroupsT1082 System Information DiscoveryT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1110 Brute ForceT1110.003 Password SprayingT1204.002 Malicious FileT1518 Software DiscoveryT1534 Internal SpearphishingT1546.003 Windows Management Instrumentation Event SubscriptionT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1567.002 Exfiltration to Cloud StorageT1583.001 DomainsT1583.002 DNS ServerT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.002 Email AccountsT1588.002 ToolT1589 Gather Victim Identity InformationT1589.002 Email AddressesT1591.004 Identify RolesT1608.001 Upload Malware

Software

12 malware/tools attributed to this actor.

MimikatzPingipconfignetstatBITSAdminEmpirePoshC2DanBotMilanSharkKevinDnsSystem

Related corpus activity

9,909 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to HEXANE.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2022-47945cve—851
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,909.