HEXANE

HEXANE has used WMI event subscriptions for persistence.^[2]

During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.^[8][6]

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.^[5][9][2]

During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.^[8][7]

During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.^[7]

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.^[3]

During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.^[8]

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.^[5][3]

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.^[3]

During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.^[7]

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.^[8][7]

HEXANE has run net localgroup to enumerate local groups.^[2]

HEXANE has used Base64-encoded scripts.^[2]

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.^{[5][1][3][10]}

During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.^[8]

During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.^[8][7]

HEXANE has used cloud services, including OneDrive, for C2.^[11]

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.^[5][1][3]

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.^[2][5][10]

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.^[8][7]

During HomeLand Justice, threat actors used custom tooling to acquire tokens using ImpersonateLoggedOnUser/SetThreadToken.^[7]

During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.^[8]

HEXANE has used compromised accounts to send spearphishing emails.^[5]

During HomeLand Justice, threat actors added the ApplicationImpersonation management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.^[7]

HEXANE has used a PowerShell-based keylogger named kl.ps1.^[5][2]

HEXANE has used remote desktop sessions for lateral movement.^[5]

During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.^[8][7]

HEXANE has used cloud services, including OneDrive, for data exfiltration.^[11]

HEXANE has used a scheduled task to establish persistence for a keylogger.^[2]