File · LYCEUM · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06
LYCEUM
- COBALT LYCEUM
- HEXANE
- UNC1530
- Spirlin
- MYSTICDOME
- siamesekitten
- Chrono Kitten
- Storm-0133
state sponsor · Iran (Islamic Republic of)MITRE G1001 ↗
attack rose · 36 techniques across 11 tactics
Analyst brief
misp-galaxy + mitre-attackLyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage techniques and has been linked to other Iranian threat groups such as APT34. They have developed and deployed malware families like Shark and Milan, and have been observed using DNS tunneling and HTTPfor command and control communication.
Observed targets (as stated by the sources)
1 countries · 7 sectorsassessed origin · Iranobserved targets · 1
countries · 1
- Israel
sectors · 7
- Government
- Energy
- High-Tech
- Telecomms
- Education
- Military
- Defense
also stated: Middle East
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique36 techniques · 11 of 15 tactics
Reconnaissance
3 techniquesResource development
7 techniquesExecution
4 techniquesPrivilege escalation
1 techniqueStealth
1 techniqueCredential access
4 techniquesDiscovery
10 techniquesLateral movement
2 techniquesCollection
1 techniqueCommand and control
2 techniquesExfiltration
1 technique
select a technique
Arsenal
5 malware · 7 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
9 sources- 1.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign
- 2.secureworks.com/research/threat-profiles/cobalt-lyceum
- 3.prevailion.com/latest-targets-of-cyber-group-lyceum
- 4.clearskysec.com/siamesekitten
- 5.vblocalhost.com/uploads/VB2021-Kayal-etal.pdf
- 6.services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cy…
- 7.attack.mitre.org/groups/G1001
- 8.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns
- 9.dragos.com/resource/hexane
Track LYCEUM on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.