Skip to main content
OT Atlas

Threats · Activity group

HEXANE

activeIT access with OT relevanceDragosAttribution · Moderate
Last verified

Executive summary

HEXANE is reported for targeting oil and gas and telecommunications organisations, with public reporting describing overlap with activity other vendors track as an Iran-linked cluster. Reported tradecraft is largely IT-side: phishing, credential theft and access to organisations that operate industrial processes.

At a glance

Tracked byDragos
NexusReported by vendors as Iran-linked
First observed2018 (public reporting)
Last reportedContinued vendor tracking
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

HEXANE
  • OilRig-adjacent reporting
    Technical overlapLow

    Tracked by Multiple vendors

  • Lyceum
    Technical overlapModerate

    Tracked by Secureworks

Relevance

Why OT defenders care

Objectives

  • Access to oil and gas organisations
  • Credential collection
  • Telecommunications access for onward operations

Reported impacts

  • No publicly confirmed OT process effects

Observed behaviours

  • Spearphishing with malicious documents
  • DNS tunnelling for command and control
  • Credential harvesting

Targeting

Sectors, geography and assets

Target industries

Oil and gasTelecommunications

Target geography

Middle EastAfrica

Observed assets

Corporate IT supporting OTRemote access gateway

Protocols in scope

SMTPHTTPSDNS

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

  • Custom backdoors reported by vendors
  • DNS-based command and control

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Not publicly established

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • DNS monitoring and egress control
  • Phishing-resistant MFA
  • Segmentation of OT-supporting IT

Hunt for this activity

  • DNS anomaliesDNS is being used as a command-and-control or exfiltration channel from an OT-supporting network.
  • Beacon-like periodic connectionsA host is contacting a destination at a regular interval consistent with automated check-in.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.
Last verified