H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Milan](https://attack.mitre.org/software/S1015) is a backdoor implant based on [DanBot](https://attack.mitre.org/software/S1014) that was written in Visual C++ and .NET. [Milan](https://attack.mitre.org/software/S1015) has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2020.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)

Labels

malware

21 recorded

Relationships

uses

Group

uses

to Component Object Model

Technique

uses

to Data from Local System

Technique

uses

to DNS

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Double File Extension

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Protocol Tunneling

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S1015

James

—

Accenture Lyceum Targets November 2021

https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns

ClearSky Siamesekitten August 2021

https://www.clearskysec.com/siamesekitten/

Kaspersky Lyceum October 2021

https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf