MalwareUsed by 2 actors

DanBot

DanBot is a Windows remote access trojan and backdoor associated with the Iranian espionage cluster tracked as Lyceum, also known as Hexane and SiameseKitten, and linked by multiple researchers to OilRig/APT34 activity. It appeared in Lyceum intrusion chains from at least 2018 and was later supplemented or replaced in some operations by the Shark, Milan, and Marlin backdoors. DanBot has been used in cyberespionage campaigns targeting organizations in the Middle East, including diplomatic, technology, medical, IT, and communications sectors, with notable victimology in Israel, Tunisia, and the United Arab Emirates.

DanBot has commonly been delivered through spearphishing emails carrying malicious Excel attachments. These lures relied on user execution and embedded VBA macros to drop the payload onto the victim system. The malware has also been observed establishing persistence through Windows Scheduled Tasks. In addition to masquerading as legitimate remote administration software, DanBot samples have used names intended to resemble VNC utilities, consistent with defense-evasion tradecraft.

Functionally, DanBot provides remote access capabilities and has been observed uploading files from compromised hosts, supporting post-compromise collection and exfiltration workflows. Reporting on related Lyceum tooling indicates overlapping design and operational patterns across the group’s backdoors, including similar command execution behavior and shared implementation artifacts, placing DanBot within a broader long-running Iranian cyberespionage ecosystem focused on persistent access and intelligence collection.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

HEXANE

The Lyceum infection chains are also notable for the fact that they have evolved to drop multiple backdoors since the campaign came to light in 2018 — beginning with DanBot and transitioning to Shark and Milan in 2021...

via the hacker newsthehackernews.com

OilRig

Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

ESET, noting that initial access to the network was achieved by means of spear-phishing as well as remote access and administration software like ITbrain and TeamViewer

T1566.001Spearphishing AttachmentEvidence3

The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.

Execution

6 techniques

T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

T1059.003Windows Command ShellEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

T1059.005Visual BasicEvidence3

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

T1204User ExecutionEvidence1

The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.

T1204.002Malicious FileEvidence4

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence1

T1036MasqueradingEvidence2

During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.

T1036.005Match Legitimate Resource Name or LocationEvidence2

Akira has used legitimate names and locations for files to evade defenses.

T1070.004File DeletionEvidence6

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

T1140Deobfuscate/Decode Files or InformationEvidence5

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

Lateral Movement

1 technique

T1021.005VNCEvidence1

Collection

1 technique

T1005Data from Local SystemEvidence1

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence4

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

T1071.004DNSEvidence1

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

hash.sha256●●●●●●●●●●●●View more in app—

ip.v4●●●●●●●●●●●●View more in app—

hash.md5●●●●●●●●●●●●View more in app—

hash.sha1●●●●●●●●●●●●View more in app—

hash.sha256●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

eset welivesecurity blogNews

Jun 5, 2025

BladedFeline: Whispering in the dark

A backdoor attributed to the Lyceum subgroup within OilRig, mentioned as part of the broader OilRig tooling ecosystem.

eset welivesecurity blogNews

Dec 14, 2023

OilRig’s persistent attacks using cloud service-powered downloaders

Backdoor attributed to Lyceum/OilRig; mentioned as part of the group’s toolset (details not expanded in this text).

mitre attack websiteNews

Oct 25, 2022

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Uses embedded Excel VBA macros to drop its payload.

the hacker newsNews

Feb 9, 2022

Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign

An earlier Lyceum backdoor in the evolution of the campaign's malware toolset.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DanBot