HEXANE
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.
- ATT&CK ID
- G1001
- Techniques
- 29
- Tools
- 12
Also tracked as Lyceum · Siamesekitten · Spirlin
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Org Information
Resource Development
Acquire InfrastructureEstablish AccountsCompromise AccountsObtain CapabilitiesStage Capabilities
Execution
Scheduled Task/JobCommand and Scripting InterpreterUser Execution
Persistence
Scheduled Task/JobEvent Triggered Execution
Privilege Escalation
Scheduled Task/JobEvent Triggered Execution
Stealth
Obfuscated Files or Information
Credential Access
Input CaptureBrute ForceCredentials from Password Stores
Discovery
Application Window DiscoverySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoverySoftware Discovery
Lateral Movement
Remote ServicesInternal Spearphishing
Collection
Command and Control
Web ServiceIngress Tool Transfer
Exfiltration
Software
BITSAdmin · DanBot · DnsSystem · Empire · Kevin · Milan · Mimikatz · Ping · PoshC2 · Shark · ipconfig · netstat