HEXANE
IntrusionSet · ATTACK:enterprise:G1001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1001",
"title": "HEXANE",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
"external_id": "G1001",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2026-07-31T20:48:51.374Z",
"version": "2.3",
"aliases": [
"HEXANE",
"Lyceum",
"Siamesekitten",
"Spirlin"
],
"tactics": [
],
"source_references": [
{
"source_name": "Spirlin"
},
{
"source_name": "Siamesekitten"
},
{
"source_name": "Lyceum"
},
{
"source_name": "Accenture Lyceum Targets November 2021",
"url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
},
{
"source_name": "ClearSky Siamesekitten August 2021",
"url": "https://www.clearskysec.com/siamesekitten/"
},
{
"source_name": "Dragos Hexane",
"url": "https://dragos.com/resource/hexane/"
},
{
"source_name": "Kaspersky Lyceum October 2021",
"url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
},
{
"source_name": "SecureWorks August 2019",
"url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
}
]
}Explicit source assertions (48)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01f4b583-4bd0-47eb-a108-c0bd7fd4d571
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0545e60c-080c-4930-a729-b3ce7dc51979
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06219288-2833-4a8e-b8bc-10a834e3af7f
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S1015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b0b4079-f926-4d86-9943-3074b487800c
Accenture Lyceum Targets November 2021 · Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ce9c0f3-6da9-402c-adc4-a001877e40e6
ClearSky Siamesekitten August 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14080577-f5de-46fd-b363-e3f4b4e73495
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1503d568-e350-4021-ac47-a0913f6f4f1d
ClearSky Siamesekitten August 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f238bb1-62c0-409b-ac79-38b38f54497d
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e10d85-b8de-45d9-9c3c-b02e53676f9c
ClearSky Siamesekitten August 2021 · Dragos Hexane · SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c9905cb-74f6-482e-b346-99be8105111c
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cc576f4-9d7d-47e4-a6c5-a6910f8b5b62
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed90af5-43e7-4c81-b03d-6d4b54988d75
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36693ec3-9b3c-4129-af32-b8372c75211c
ClearSky Siamesekitten August 2021 · Dragos Hexane · SecureWorks August 2019 · Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b9f9fae-f68a-419b-9551-5485f8851500
Microsoft POLONIUM June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S1019
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40563725-bb7f-40a2-b2da-c4cfd7799c13
Accenture Lyceum Targets November 2021 · Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--428a1a44-f1bc-4589-94de-946233489905
ClearSky Siamesekitten August 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--486e3108-33ad-4506-8031-7215acd5ff69
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b4ccf27-d9e2-4cd9-b783-e8cdf354e6dc
Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f7d0afb-471e-42e9-9a65-8d8aa8635ac5
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c8e77a8-03f4-4581-a893-a07016bc155f
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ffa504a-4458-49af-affd-f392bf5dd0ef
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6679b9ed-d9ec-4ff3-9961-24f39814f6d0
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66d2bbd8-1a92-4a5a-80d1-4a11860c64f3
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eca6ae2-3f86-4b45-86c4-0ac01dfd13dd
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76ef2eb1-a94c-4dd8-be1e-ccb63d577d9e
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82c32444-f9a1-4370-b72c-2db8c91e9ac3
Microsoft POLONIUM June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86a7e0a4-4fbd-4355-9428-f0b79249d225
Kaspersky Lyceum October 2021 · SecureWorks August 2019 · Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d588be8-f13d-458d-9480-f39ef82197d6
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e0a0a20-e78f-491b-b828-934525bf160b
Kaspersky APT Trends Q1 April 2021 · Kaspersky Lyceum October 2021 · SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3e07b45-b35d-4d02-a266-34366a57f557
ClearSky Siamesekitten August 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a57d19ce-7a9a-4be5-ae59-a0b331bcc03a
ClearSky Siamesekitten August 2021 · SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0363
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa83b2a0-9941-461f-b9be-a758315f0c4d
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad5e568c-376c-4ab8-be50-e965feb0c160
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba2c0c39-5b92-45d1-827f-5f2b454d3981
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc0c33f3-211b-4b39-ac75-9d8693897b7f
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bed01612-b213-44dc-aabc-19ea87ef28b8
ClearSky Siamesekitten August 2021 · Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8470c56-2c81-4826-804c-44e53d87333f
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cca0aac6-bdc2-48da-9b95-c24e41f5a116
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cecdfe74-68df-4008-8d83-226d0de77782
Kaspersky Lyceum October 2021 · SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3971408-ef1b-4aae-9477-3319a1b97523
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5d91a04-cdc9-404b-9c8f-7e91a266185d
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df6bb7e8-1971-4e8c-92cc-16727ac996dd
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8713274-bcbc-4c18-bf06-2c2a0c01d2ba
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e966a89a-eef3-4be4-9ea1-ded6da1315cd
Kaspersky Lyceum October 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1591.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecce47d4-c937-4feb-8ebf-4e2eb496725d
ClearSky Siamesekitten August 2021 · SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0378
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f612ed23-f9c3-4527-b23a-3361f90f5fe1
SecureWorks August 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1583.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f635daec-033b-4d91-afa6-4a6f44f9dddb
Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6a8aba6-d711-45bd-a99e-7a12b8c72ae0
SecureWorks August 2019