LYCEUM__2019__Cyber_Threat_Group_LYCEUM_Takes_Center_Stage_in_Middle_East_Campaign.pdf

Secureworks CTU describes LYCEUM (also reported as HEXANE), an emerging APT that has conducted multi-year spearphishing and credential-based intrusions against energy and critical infrastructure targets in the Middle East, deploying DanBot (a C# RAT) via malicious Excel macros (DanDrop), a PowerShell keylogger (kl.ps1), and post-exploitation scripts; the report includes technical behavior, C2 details (DNS/HTTP), domains/IPs, file hashes, and mitigation recommendations such as MFA, enhanced endpoint visibility, and phishing awareness.