LYCEUM

Also known as COBALT LYCEUM, HEXANE, UNC1530, Spirlin, MYSTICDOME, siamesekitten, Chrono Kitten, Storm-0133

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage techniques and has been linked to other Iranian threat groups such as APT34. They have developed and deployed malware families like Shark and Milan, and have been observed using DNS tunneling and HTTPfor command and control communication.

Targets: Government, Energy, High-Tech, Telecomms, Education, Military, Defense, Israel, Middle East

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1010 Application Window Discovery T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1027.010 Command Obfuscation T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1053.005 Scheduled Task T1056.001 Keylogging T1057 Process Discovery T1059.001 PowerShell T1059.005 Visual Basic T1069.001 Local Groups T1082 System Information Discovery T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1110 Brute Force T1110.003 Password Spraying T1204.002 Malicious File T1518 Software Discovery T1534 Internal Spearphishing T1546.003 Windows Management Instrumentation Event Subscription T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers T1567.002 Exfiltration to Cloud Storage T1583.001 Domains T1583.002 DNS Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool T1589 Gather Victim Identity Information T1589.002 Email Addresses T1591.004 Identify Roles T1608.001 Upload Malware

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.