Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionageAdvanced sophistication · State-backed

HEXANE

HEXANE is an Iran-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 6 sectors, including Government and Technology, in 9 countries, including the United Kingdom and France. It uses 49 MITRE ATT&CK techniques.

Also known as
  • Lyceum
  • Siamesekitten
  • Spirlin
  • Cobalt Lyceum
  • ATK 120
  • Yellow Dev 9
  • G1001
  • Operation “Out to Sea”
Request IOC feedRequest ATT&CK export
Origin
Iran
Techniques
49
Exploited CVEs
No CVE data
First seen
Jan 1, 2017
Last seen
Jun 9, 2022
Record updated

Who They Target.

Sectors · 6
Countries · 9
Labelsespionagemena

About HEXANE.

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia.

Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.