DanBot

DanBot is a Windows remote access trojan and backdoor associated with the Iranian espionage cluster tracked as Lyceum, also known as Hexane and SiameseKitten, and linked by multiple researchers to OilRig/APT34 activity. It appeared in Lyceum intrusion chains from at least 2018 and was later supplemented or replaced in some operations by the Shark, Milan, and Marlin backdoors. DanBot has been used in cyberespionage campaigns targeting organizations in the Middle East, including diplomatic, technology, medical, IT, and communications sectors, with notable victimology in Israel, Tunisia, and the United Arab Emirates.

DanBot has commonly been delivered through spearphishing emails carrying malicious Excel attachments. These lures relied on user execution and embedded VBA macros to drop the payload onto the victim system. The malware has also been observed establishing persistence through Windows Scheduled Tasks. In addition to masquerading as legitimate remote administration software, DanBot samples have used names intended to resemble VNC utilities, consistent with defense-evasion tradecraft.

Functionally, DanBot provides remote access capabilities and has been observed uploading files from compromised hosts, supporting post-compromise collection and exfiltration workflows. Reporting on related Lyceum tooling indicates overlapping design and operational patterns across the group’s backdoors, including similar command execution behavior and shared implementation artifacts, placing DanBot within a broader long-running Iranian cyberespionage ecosystem focused on persistent access and intelligence collection.