LYCEUM
LYCEUM is classified as state-sponsored.
- Malware families
- 3
- Suspected state sponsor
- Iran
- Also known as
- 8
Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the energy and telecommunications sectors. Lyceum is known for using cyber espionage techniques and has been linked to other Iranian threat groups such as APT34. They have developed and deployed malware families like Shark and Milan, and have been observed using DNS tunneling and HTTPfor command and control communication.
The group is suspected of operating with the support of Iran.
The group is associated with 3 malware families.
Also known as: COBALT LYCEUM, HEXANE, UNC1530, Spirlin, MYSTICDOME, siamesekitten, Chrono Kitten, Storm-0133
The group is associated with 3 malware families.
Malware families
- Lyceum .NET DNS Backdoor
- Lyceum .NET TCP Backdoor
- Lyceum Golang HTTP Backdoor
Published reports on this actor:
- https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign
- https://www.secureworks.com/research/threat-profiles/cobalt-lyceum
- https://www.prevailion.com/latest-targets-of-cyber-group-lyceum/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.