HEXANE (G1001) | Threat Actor Index

About HEXANE

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.

View MITRE record ↗

Techniques by Tactic (36)

Reconnaissance

T1589 Gather Victim Identity InformationT1589.002 Email AddressesT1591.004 Identify Roles

Resource Development

T1583.001 DomainsT1583.002 DNS ServerT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.002 Email AccountsT1588.002 ToolT1608.001 Upload Malware

Execution

T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription

Privilege Escalation

T1053.005 Scheduled TaskT1546.003 Windows Management Instrumentation Event Subscription