Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/27/2019
02:35 PM
50%
50%

New 'Lyceum' Threat Group Eyes Critical Infrastructure

Researchers report Lyceum, otherwise known as Hexane, has targeted organizations in South Africa and the Middle East.

Newly discovered threat group Lyceum has been spotted attacking critical infrastructure firms in the oil and gas, and possibly telecommunications, industries with the goal of gaining and expanding access inside target networks, Secureworks' Counter Threat Unit researchers report.

Lyceum may have been active as early as April 2018, when domain registrations indicate an attack on South African targets. One year later, after developing and testing its toolkit against a public malware-scanning service, Lyceum launched a May 2019 campaign against oil and gas businesses in the Middle East. It prioritizes organizations in strategically important industries.

Attackers typically use password spraying or brute force to gain credentials they need to break in. They use access to compromised accounts to send spearphishing emails containing malicious Excel attachments, which install DanBot malware to deploy post-intrusion tools. DanBot is one of several attack tools researchers have observed in Lyceum's arsenal, they write in a blog post.

Spear-phishing emails are usually sent from compromised accounts to specific executives, human resources staff, and IT personnel. Targets are more likely to open emails from internal accounts, and each of these groups could further attackers' access to sensitive data: HR personnel may have information that could prove useful for future spearphishing attacks, and IT personnel have access to high-privilege accounts and data specific to the firm's environment.

The group is an emerging threat to energy organizations in the Middle East, researchers say, but organizations should assume Lyceum will branch out to other sectors. Critical infrastructure firms should pay particular attention, they caution. The group doesn't appear to have demonstrated an interest in industrial control systems or OT staff thus far; however, there is a possibility attackers could leverage access to IT environments to spread into the OT environment.

Lyceum's tactics are similar to activities from other groups Cobalt Gypsy and Cobalt Trinity, but none of the malware or infrastructure linked to Lyceum has been directly linked to other groups. Researchers say there isn't enough technical evidence to support attribution.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7856
PUBLISHED: 2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
CVE-2021-28793
PUBLISHED: 2021-04-20
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
CVE-2021-25679
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed....
CVE-2021-25680
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only...
CVE-2021-25681
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The aff...