Loading threat actor…
Lyceum, also known as Hexane, SiameseKitten, Spirlin, and Storm-0133, is an Iranian cyber-espionage threat actor active since at least 2017 and associated with operations across the Middle East and Africa. The group has targeted organizations of strategic importance, including oil and gas, telecommunications, information technology, government, diplomatic, health care, and communications entities. Israeli organizations have been a recurring focus, including energy, IT, and communications companies, with some operations assessed as having supply-chain objectives. Additional targeting has been reported in Tunisia, the United Arab Emirates, Saudi Arabia, Morocco, and elsewhere in the region. Lyceum is widely assessed as an Iran-nexus espionage actor, and multiple reports connect it to the broader OilRig/APT34 ecosystem; some reporting describes it as a subgroup or closely linked cluster. Technical overlaps have also been noted with other MOIS-linked Iranian activity. More recent reporting identified similarities between Lyceum and the Cavern framework ecosystem, including low-confidence links to HollowGraph activity targeting Israeli entities, but attribution of those specific operations to Lyceum remains unconfirmed. The actor commonly relies on spearphishing, social engineering, and impersonation. Observed lures have included recruiter personas, fake job offers, malicious Office documents with macros, password-protected archives, and executable droppers disguised as legitimate files. In some campaigns the group also abused remote administration software for access. Lyceum has conducted supply-chain-oriented intrusions by compromising or attempting to compromise IT and communications providers as a path to downstream victims. Its malware and tooling have included DanBot, Milan, Shark, Marlin, and related backdoors, with command-and-control over DNS tunneling, HTTP/S, and in some cases cloud services such as Microsoft OneDrive API. Reported capabilities include credential theft from browsers, keylogging, PowerShell-based execution, VBScript-assisted payload launch, user and system discovery, hostname collection, process enumeration, file upload and download, arbitrary command execution, screenshot capture, persistence via scheduled tasks, and broader post-compromise reconnaissance. The group has also used DNS-based command-and-control tradecraft and modular backdoor designs to support long-term espionage operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
21 malware families attributed to this actor across reporting.
16 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
186 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Likely operator of the Cavern framework and associated with the HollowGraph backdoor used to compromise Microsoft 365 mailboxes, hide C2 in mailbox calendars, maintain persistence via Microsoft Graph API and DNS, and target Israeli organizations.
Listed as one of many threat actors associated with the detection's ATT&CK-style annotations for PowerShell and DNS TXT command-and-control behavior; no specific campaign or activity is described in this reference.
Mentioned as a possible but low-confidence attribution link based on malware similarities to the Cavern framework; no definitive operational attribution is made in the content.
Iran-linked subgroup discussed as a low-confidence attribution candidate for the HollowGraph activity based on technical similarities.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.