{
  "id": "hexane",
  "name": "HEXANE",
  "aliases": [
    "Lyceum",
    "Siamesekitten",
    "Spirlin"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Unattributed cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Not attributed by ATT&CK; TTPs similar to APT33 and OilRig",
      "src": [
        "mitre-g1001"
      ],
      "conf": "low"
    },
    {
      "k": "active_since",
      "v": 2017,
      "src": [
        "mitre-g1001"
      ],
      "conf": "medium",
      "note": "At least 2017"
    },
    {
      "k": "attack_id",
      "v": "G1001",
      "src": [
        "mitre-g1001"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017.",
      "src": [
        "mitre-g1001"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 36,
      "src": [
        "mitre-g1001"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BITSAdmin, DanBot, DnsSystem, Empire, ipconfig, Kevin, Milan, Mimikatz, netstat, Ping, PoshC2, Shark",
      "src": [
        "mitre-g1001"
      ],
      "conf": "high",
      "note": "12 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1001)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/hexane.html",
  "sources": {
    "mitre-g1001": {
      "title": "HEXANE, Group G1001",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1001/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}