Lyceum

Summary

Iran-aligned cyberespionage group, active since at least 2017, that MITRE tracks as HEXANE (G1001) against oil and gas, telecommunications, aviation and ISP organisations in the Middle East and Africa (Israel, Saudi Arabia, Kuwait, Morocco, Tunisia). MITRE keeps it separate from OilRig and APT33 because of differences in victims and tools, while ESET and Check Point describe Lyceum as an OilRig subgroup. ClearSky documented its 2021 Siamesekitten campaign against Israeli IT companies, impersonating the firms and their HR staff to deliver the Milan and Shark backdoors as a route to their clients. In early 2025 ESET found it operating alongside MuddyWater against Israeli targets, including a utilities organisation it compromised on 11 February 2025. Check Point's 2026 Cavern Manticore cluster overlaps with its tradecraft (victim-side C2 proxying, XOR/Base64 obfuscation, fixed verb sets).

Attribution

OilRig itself is assessed MOIS-linked (see OilRig)

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET (Research, 2025-12-02)
  A subgroup of Iran-aligned OilRig
• ClearSky (Research, 2021-08-17)
  An Iranian APT group

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 8

Malware and tools 5

Infrastructure patterns

• Custom DNS servers that deliver commands to implants through TXT records (MITRE ATT&CK, 2026)
• OneDrive and other cloud services for C2 and exfiltration (ESET, 2025; MITRE ATT&CK, 2026)
• ProtonMail accounts used to register its domains (MITRE ATT&CK, 2026)
• Large impersonation infrastructure posing as real companies and their HR staff for recruitment lures (ClearSky, 2021)

Reporting and advisories 3

• MITRE ATT&CK
  HEXANE (G1001)
• ClearSky
  Siamesekitten
• ESET
  MuddyWater: Snakes by the riverbank (Lyceum overlap)