HEXANE

{
  "id": "ATTACK:ics:G1001",
  "title": "HEXANE",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1001",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
  "external_id": "G1001",
  "domain": "ics",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2026-07-31T20:48:51.374Z",
  "version": "2.3",
  "aliases": [
    "HEXANE",
    "Lyceum",
    "Siamesekitten",
    "Spirlin"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Spirlin"
    },
    {
      "source_name": "Siamesekitten"
    },
    {
      "source_name": "Lyceum"
    },
    {
      "source_name": "Accenture Lyceum Targets November 2021",
      "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
    },
    {
      "source_name": "ClearSky Siamesekitten August 2021",
      "url": "https://www.clearskysec.com/siamesekitten/"
    },
    {
      "source_name": "Dragos Hexane",
      "url": "https://dragos.com/resource/hexane/"
    },
    {
      "source_name": "Kaspersky Lyceum October 2021",
      "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
    },
    {
      "source_name": "SecureWorks August 2019",
      "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
    }
  ]
}