HEXANE

Techniques (MITRE ATT&CK)36

SourceMITRE ATT&CK

State sponsor: Iran (Islamic Republic of)Attribution confidence: 50%Target categories: Government, Energy, High-Tech, Telecomms, Education, Military, Defense

Targeted regions: Israel · Middle East

Also known as:COBALT LYCEUMChrono KittenLyceumMYSTICDOMESiamesekittenSpirlinStorm-0133UNC1530siamesekitten

About the group

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity46

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 36

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Email Addresses Identify Roles

Resource development

Domains DNS Server Social Media Accounts Email Accounts Email Accounts Tool Upload Malware

Execution

Scheduled Task PowerShell Visual Basic Malicious File

Privilege escalation

Windows Management Instrumentation Event Subscription

Credential access

Brute Force Password Spraying Credentials from Password Stores Credentials from Web Browsers

Discovery

Application Window Discovery System Network Configuration Discovery Internet Connection Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery Process Discovery Local Groups System Information Discovery Software Discovery

Lateral movement

Remote Desktop Protocol Internal Spearphishing

Collection

Keylogging

Command and control

Bidirectional Communication Ingress Tool Transfer

Exfiltration

Exfiltration to Cloud Storage

stealth

Command Obfuscation

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

HEXANE uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →