Trusted Design

HEXANE

アクターID: G1001

· MITRE Pageへのリンク

脅威アクターの詳細

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

脅威アクターの別名・別称

HEXANE
Lyceum
Siamesekitten
Spirlin

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1557 - Adversary-in-the-Middle
• T1596.003 - Digital Certificates
• T1099 - Timestomp
• T1499.003 - Application Exhaustion Flood
• T1087.002 - Domain Account
• T1120 - Peripheral Device Discovery
• T1024 - Custom Cryptographic Protocol
• T1091 - Replication Through Removable Media
• T1562 - Impair Defenses
• T1098.007 - Additional Local or Domain Groups
• T1070.006 - Timestomp
• T1547.005 - Security Support Provider
• T1562.012 - Disable or Modify Linux Audit System
• T1183 - Image File Execution Options Injection
• T1027.016 - Junk Code Insertion
• T1134.002 - Create Process with Token
• T1590.006 - Network Security Appliances
• T1055.004 - Asynchronous Procedure Call
• T1583.006 - Web Services
• T1204 - User Execution
• T1497.002 - User Activity Based Checks
• T1055.014 - VDSO Hijacking
• T1212 - Exploitation for Credential Access
• T1199 - Trusted Relationship
• T1097 - Pass the Ticket
• T1565 - Data Manipulation
• T1547.002 - Authentication Package
• T1056 - Input Capture
• T1065 - Uncommonly Used Port
• T1601.001 - Patch System Image
• T1027.010 - Command Obfuscation
• T1134 - Access Token Manipulation
• T1159 - Launch Agent
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion

関連するCVE (攻撃手法に関連)

• CVE-2013-6282 (T1562.012)
• CVE-2025-55182 (T1055.014)
• CVE-2023-1389 (T1134)
• CVE-2025-13928 (T1055.014)
• CVE-2025-24893 (T1055.014)
• CVE-2025-34026 (T1159)
• CVE-2025-55184 (T1055.014)
• CVE-2025-68645 (T1055.014)
• CVE-2014-4114 (T1027.010)
• CVE-2015-5119 (T1097)
• CVE-2015-5122 (T1159)
• CVE-2015-1427 (T1499.003)
• CVE-2015-1770 (T1622)
• CVE-2012-1856 (T1027.010)
• CVE-2015-2545 (T1091)
• CVE-2015-2546 (T1055.014)
• CVE-2014-6332 (T1027.010)
• CVE-2015-3785 (T1055.014)
• CVE-2015-5897 (T1562.012)
• CVE-2015-7645 (T1055.014)
• CVE-2017-0199 (T1622)
• CVE-2017-12149 (T1055.014)
• CVE-2015-3043 (T1134)
• CVE-2015-3456 (T1055.014)
• CVE-2015-3090 (T1065)
• CVE-2010-1553 (T1499.003)
• CVE-2015-3113 (T1097)
• CVE-2015-2590 (T1055.014)
• CVE-2015-2424 (T1091)
• CVE-2015-0097 (T1027.010)
• CVE-2012-0158 (T1027.010)
• CVE-2014-1761 (T1055.014)
• CVE-2015-2502 (T1091)
• CVE-2014-6271 (T1055.014)
• CVE-2013-2094 (T1562.012)
• CVE-2014-4113 (T1562.012)
• CVE-2015-8562 (T1562.012)
• CVE-2015-7808 (T1499.003)
• CVE-2012-1889 (T1055.014)
• CVE-2016-1010 (T1055.014)
• CVE-2016-1019 (T1055.014)
• CVE-2016-0984 (T1055.014)
• CVE-2016-1001 (T1055.014)
• CVE-2016-0998 (T1055.014)
• CVE-2015-1641 (T1055.014)
• CVE-2015-1701 (T1212)
• CVE-2015-0313 (T1055.014)
• CVE-2015-0359 (T1134)
• CVE-2014-0329 (T1590.006)
• CVE-2015-5130 (T1055.014)
• CVE-2015-5134 (T1055.014)
• CVE-2015-5539 (T1055.014)
• CVE-2015-5557 (T1055.014)
• CVE-2015-5563 (T1055.014)
• CVE-2015-5559 (T1055.014)
• CVE-2015-5540 (T1055.014)
• CVE-2015-5561 (T1055.014)
• CVE-2015-5551 (T1055.014)
• CVE-2015-5564 (T1055.014)
• CVE-2015-5565 (T1055.014)
• CVE-2015-5550 (T1055.014)
• CVE-2015-5566 (T1055.014)
• CVE-2015-5127 (T1055.014)
• CVE-2015-5556 (T1055.014)
• CVE-2015-3628 (T1055.014)
• CVE-2015-2854 (T1055.014)
• CVE-2015-7755 (T1027.016)
• CVE-2012-4969 (T1601.001)
• CVE-2016-1287 (T1055.014)
• CVE-2015-6585 (T1183)
• CVE-2015-6022 (T1055.014)
• CVE-2016-2342 (T1055.004)
• CVE-2017-0263 (T1562.012)
• CVE-2016-9494 (T1065)
• CVE-2016-9496 (T1065)
• CVE-2016-9495 (T1065)
• CVE-2017-3212 (T1499.003)
• CVE-2015-0311 (T1055.014)
• CVE-2013-3906 (T1601.001)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1055.014)
• CVE-2012-0056 (T1055.004)
• CVE-2010-3081 (T1134.002)
• CVE-2010-3333 (T1055.014)
• CVE-2012-3213 (T1091)
• CVE-2012-4792 (T1547.013)
• CVE-2014-0322 (T1027.010)
• CVE-2012-1258 (T1055.004)
• CVE-2015-0336 (T1055.014)
• CVE-2011-3544 (T1091)
• CVE-2014-3153 (T1562.012)
• CVE-2014-7911 (T1091)
• CVE-2014-4322 (T1499.003)
• CVE-2015-3636 (T1055.004)
• CVE-2015-3105 (T1055.014)
• CVE-2014-0497 (T1055.014)
• CVE-2014-8361 (T1055.014)
• CVE-2013-0074 (T1055.014)
• CVE-2012-0507 (T1055.014)
• CVE-2013-2465 (T1091)
• CVE-2014-8439 (T1055.014)
• CVE-2013-2551 (T1055.014)
• CVE-2010-0188 (T1091)
• CVE-2014-0569 (T1055.014)
• CVE-2014-0515 (T1055.014)
• CVE-2012-4681 (T1159)
• CVE-2014-1776 (T1159)
• CVE-2014-0556 (T1055.014)
• CVE-2012-1876 (T1055.014)
• CVE-2015-5560 (T1055.014)
• CVE-2015-0057 (T1562.012)
• CVE-2012-2539 (T1055.014)
• CVE-2014-9163 (T1055.014)
• CVE-2012-1723 (T1091)
• CVE-2015-1761 (T1562.012)
• CVE-2014-8440 (T1134)
• CVE-2013-3660 (T1055.004)
• CVE-2010-0806 (T1547.013)
• CVE-2010-1297 (T1055.014)
• CVE-2010-2884 (T1055.014)
• CVE-2015-2360 (T1562.012)
• CVE-2014-4148 (T1091)
• CVE-2011-3402 (T1091)
• CVE-2010-2883 (T1499.003)
• CVE-2013-0634 (T1097)
• CVE-2014-7247 (T1091)
• CVE-2012-5054 (T1055.014)
• CVE-2013-2678 (T1055.014)
• CVE-2015-2426 (T1091)
• CVE-2008-1436 (T1055.014)
• CVE-2010-0232 (T1027.016)
• CVE-2010-4398 (T1562.012)
• CVE-2013-0641 (T1499.003)
• CVE-2013-0640 (T1087.002)
• CVE-2012-6422 (T1055.004)
• CVE-2013-2595 (T1055.014)
• CVE-2015-4902 (T1091)
• CVE-2009-3129 (T1183)
• CVE-2010-2572 (T1091)
• CVE-2011-1255 (T1055.014)
• CVE-2011-0611 (T1055.014)
• CVE-2013-5990 (T1091)
• CVE-2012-0611 (T1055.014)
• CVE-2015-2419 (T1091)
• CVE-2016-0189 (T1027.010)
• CVE-2016-4117 (T1055.014)
• CVE-2017-0001 (T1547.002)
• CVE-2017-0143 (T1027.010)
• CVE-2025-54313 (T1547.005)
• CVE-2025-55183 (T1055.014)
• CVE-2015-0310 (T1055.014)
• CVE-2015-6034 (T1055.004)
• CVE-2015-2852 (T1055.014)
• CVE-2015-2853 (T1055.014)
• CVE-2015-8287 (T1055.014)
• CVE-2016-2343 (T1562.012)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2017-16929 (T1055.014)
• CVE-2017-17215 (T1065)
• CVE-2015-0071 (T1547.002)
• CVE-2013-7331 (T1134)
• CVE-2014-6324 (T1562.012)
• CVE-2014-3897 (T1091)
• CVE-2015-2387 (T1562.012)
• CVE-2017-8570 (T1027.010)
• CVE-2025-31125 (T1183)
• CVE-2025-66478 (T1055.014)
• CVE-2026-20127 (T1065)
• CVE-2015-7261 (T1562)
• CVE-2015-8286 (T1562)
• CVE-2016-6532 (T1097)
• CVE-2014-3393 (T1055.004)
• CVE-2026-0723 (T1055.014)
• CVE-2016-1990 (T1562.012)
• CVE-2016-1991 (T1562.012)
• CVE-2016-1562 (T1055.014)
• CVE-2015-7262 (T1055.014)
• CVE-2014-2273 (T1562.012)
• CVE-2025-13335 (T1055.014)
• CVE-2025-13927 (T1055.014)
• CVE-2026-1102 (T1055.014)
• CVE-2016-1898 (T1055.014)
• CVE-2016-1897 (T1055.014)
• CVE-2015-6036 (T1055.014)
• CVE-2010-0738 (T1055.014)
• CVE-2017-7255 (T1134)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る