LYCEUMThreat actor
- chrono kitten
- cobalt lyceum
- hexane
- mysticdome
- siamesekitten
- spirlin
- storm-0133
- unc1530
Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage techniques and has been linked to other Iranian threat groups such as APT34.From MISP Galaxy
Last reported 3 months ago, by SentinelLabs5 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
- T1534Internal Spearphishing
“The group is also known to favor internal spearphishing from already-compromised inboxes – emails from a colleague's account rather than an external sender – with a high success rate, for obvious reasons.”
- T1556.009Conditional Access Policies
“Enforce Conditional Access policies, credential rotation, and anomalous-token detection are applied to Microsoft 365 and Entra ID environments.”
- T1566.001Spearphishing Attachment
“Spearphishing attachments and links have long been the most popular initial access techniques among most Iran-aligned APT groups, including OilRig and APT33.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“Check Point assesses an MOIS relationship based on technical and operational overlap with MuddyWater and Lyceum; public corroboration remains limited, so the mapping should remain moderate-confidence.”
-
New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 Communications“…ute to any previously identified threat actor, researchers identified several technical similarities with the Iranian-nexus threat actor Lyceum for espionage activities.”
-
HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels“However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum.”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“En particular, MuddyWater ha colaborado de cerca con Lyceum, un subgrupo de OilRig, y probablemente también ha actuado como initial access broker (IAB) para otros grupos iraníes.”
-
Cyber fallout from the Iran war: What to have on your radar“Notably, MuddyWater has worked closely with Lyceum, a subgroup of OilRig, as well as probably acted as an initial access broker (IAB) for other Iran-aligned groups.”
Indicators in its reports
named in the reports above- cloudlanecdn[.]comin 1 report
- p.cloudlanecdn[.]comin 1 report
- q.cloudlanecdn[.]comin 1 report
- co[.]ilin 1 report
- 315bdba98c6fe863…88cae56d61c1in 1 report
- 1573e125197ec77d…26b46c53bd25in 1 report
- 75e51774b8f79e5f…980255621509in 1 report
- f3f3006f83047882…101bcc851da3in 1 report
- b3d0f6e4e3be395f…bc3564485effin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.