New Lyceum Threat Group Eyes Critical Infrastructure

Researchers report Lyceum, otherwise known as Hexane, has targeted organizations in South Africa and the Middle East.

Newly discovered threat group Lyceum has been spotted attacking critical infrastructure firms in the oil and gas, and possibly telecommunications, industries with the goal of gaining and expanding access inside target networks, Secureworks Counter Threat Unit researchers report.
Lyceum may have been active as early as April 2018, when domain registrations indicate an attack on South African targets. One year later, after developing and testing its toolkit against a public malware-scanning service, Lyceum launched a May 2019 campaign against oil and gas businesses in the Middle East. It prioritizes organizations in strategically important industries.
Attackers typically use password spraying or brute force to gain credentials they need to break in. They use access to compromised accounts to send spearphishing emails containing malicious Excel attachments, which install DanBot malware to deploy post-intrusion tools. DanBot is one of several attack tools researchers have observed in Lyceums arsenal, they write in a blog post.
Spear-phishing emails are usually sent from compromised accounts to specific executives, human resources staff, and IT personnel. Targets are more likely to open emails from internal accounts, and each of these groups could further attackers access to sensitive data: HR personnel may have information that could prove useful for future spearphishing attacks, and IT personnel have access to high-privilege accounts and data specific to the firms environment.
The group is an emerging threat to energy organizations in the Middle East, researchers say, but organizations should assume Lyceum will branch out to other sectors. Critical infrastructure firms should pay particular attention, they caution. The group doesnt appear to have demonstrated an interest in industrial control systems or OT staff thus far; however, there is a possibility attackers could leverage access to IT environments to spread into the OT environment.
Lyceums tactics are similar to activities from other groups Cobalt Gypsy and Cobalt Trinity, but none of the malware or infrastructure linked to Lyceum has been directly linked to other groups. Researchers say there isnt enough technical evidence to support attribution.
Read more details
here
.
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Culture Eats Policy for Breakfast: Rethinking Security Awareness Training
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Lyceum Threat Group Eyes Critical Infrastructure