H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Shark

[Shark](https://attack.mitre.org/software/S1019) is a backdoor malware written in C# and .NET that is an updated version of [Milan](https://attack.mitre.org/software/S1015); it has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least July 2021.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Shark](https://attack.mitre.org/software/S1019) is a backdoor malware written in C# and .NET that is an updated version of [Milan](https://attack.mitre.org/software/S1015); it has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least July 2021.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Labels

malware
18 recorded

Relationships

uses
from HEXANE
Group
uses
to Data from Local System
Technique
uses
to Data Staged
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DNS
Technique
uses
to Domain Generation Algorithms
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Fallback Channels
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Query Registry
Technique
uses
to Scheduled Transfer
Technique
uses
to System Checks
Technique
uses
to System Information Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S1019
open
Accenture Lyceum Targets November 2021
https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns
open
ClearSky Siamesekitten August 2021
https://www.clearskysec.com/siamesekitten/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance