← Back to Actors
HEXANE
HEXANELyceumSiamesekittenSpirlin
[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dr...
36
Techniques
32
Covered
4
Gaps
89%
Coverage
Coverage32/36
GAPS (4)
COVERED (32)
T1010Application Window Discovery1 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery51 det.T1021.001Remote Desktop Protocol54 det.T1027.010Command Obfuscation38 det.T1033System Owner/User Discovery62 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1056.001Keylogging4 det.T1057Process Discovery23 det.T1059.001PowerShell376 det.T1059.005Visual Basic70 det.T1069.001Local Groups38 det.T1082System Information Discovery88 det.T1102.002Bidirectional Communication16 det.T1105Ingress Tool Transfer191 det.T1110Brute Force93 det.T1110.003Password Spraying69 det.T1204.002Malicious File461 det.T1518Software Discovery17 det.T1534Internal Spearphishing264 det.T1546.003Windows Management Instrumentation Event Subscription18 det.T1555Credentials from Password Stores41 det.T1555.003Credentials from Web Browsers16 det.T1567.002Exfiltration to Cloud Storage31 det.T1583.001Domains68 det.T1588.002Tool13 det.T1589Gather Victim Identity Information1 det.T1589.002Email Addresses2 det.T1591.004Identify Roles2 det.T1608.001Upload Malware3 det.