LYCEUM· Iran

LYCEUM is an Iranian nation-state cyber espionage group targeting government and energy sectors in the Middle East.

Analyst brief

LYCEUM is an Iranian nation-state APT group active since at least 2014, primarily conducting cyber espionage against government, energy, high-tech, telecom, education, military, and defense sectors in Israel and the Middle East. They gain initial access via malicious files, leverage tools like Mimikatz, Empire, and PoshC2 for credential theft, move laterally using RDP, and establish C2 communication through DNS tunneling and HTTP. Defenders should focus on detecting phishing emails, anomalous scheduled tasks, suspicious DNS queries, and known IOCs for their malware families such as Shark, Milan, and DanBot.

LYCEUM

COBALT LYCEUMHEXANEUNC1530

nation-state

Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage techniques and has been linked to other Iranian threat groups such as APT34. They have developed and deployed malware families like Shark and Milan, and have been observed using DNS tunneling and HTTPfor command and control communication.

origin (suspected)

Iran· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

IsraelMiddle East

target sectors

GovernmentEnergyHigh-TechTelecomms

techniques · ATT&CK

Gather Victim Identity Information Email Addresses Domains Social Media Accounts Scheduled Task Malicious File Windows Management Instrumentation Event Subscription Command Obfuscation+8

malware

Milan Shark DnsSystem DanBot Kevin Ping+6

source: misp-galaxy + mitre-attackG1001 9 refs →

Kill-chain playbook11

01
reconnaissance
T1589 T1589.002
Implement email monitoring to detect suspicious email addresses being gathered and monitor for unusual queries.
02
resource-development
T1583.001 T1585.001
Monitor social media account registrations and domain registrations, and investigate suspicious activity.
03
execution
T1053.005 T1204.002
Monitor system logs for creation of scheduled tasks and execution of malicious files, and block suspicious activity.
04
privilege-escalation
T1546.003
Monitor Windows Management Instrumentation (WMI) event subscription and investigate suspicious WMI queries.
05
stealth
T1027.010
Monitor command line for suspicious command lines and block suspicious commands.
06
credential-access
T1110 T1555
Monitor authentication logs for credentials being harvested from password stores and brute force attacks.
07
discovery
T1016 T1082
Monitor system logs for system network configuration and system information discovery.
08
lateral-movement
T1021.001
Monitor RDP traffic to detect and block suspicious RDP activity.
09
collection
T1056.001
Monitor user activity to detect suspicious keyboard activity and block suspicious keylogging.
10
command-and-control
T1102.002
Monitor network traffic to detect suspicious bidirectional communication and block suspicious C2 traffic.
11
exfiltration
T1567.002
Monitor network traffic to detect suspicious exfiltration to cloud storage and block suspicious exfiltration.

FAQ2

In which region is the LYCEUM group most active?

Primarily targeting government, energy, high-tech, telecom, education, military, and defense sectors in Israel and the Middle East.

What methods does LYCEUM use for C2 communication?

Establishes C2 communication through DNS tunneling and HTTP.

LYCEUM· Iran

Analyst brief

LYCEUM

Kill-chain playbook11

reconnaissance

resource-development

execution

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also4

LYCEUM· Iran

Analyst brief

LYCEUM

Kill-chain playbook11

reconnaissance

resource-development

execution

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also4