Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
DanBot
DanBot is a backdoor associated with the Lyceum threat group.
Profile source: Mallory opens in a new tabDanBot
Family profile
DanBot is a backdoor associated with the Lyceum threat group. It has been delivered via spearphishing emails containing malicious Excel attachments and relies on victim interaction to execute, including opening the malicious file. The malware can use a VBA macro embedded in an Excel file to drop its payload and can establish installation or persistence through a scheduled task. DanBot samples have been named UltraVNC.exe and WINVNC.exe to masquerade as legitimate VNC tools. Reported capabilities include uploading files from compromised hosts. The provided content identifies DanBot as one of the major tools attributed to Lyceum, alongside the Shark, Milan, and Marlin backdoors.
Reported operators
Threat actors
2 named in public reportingMajor tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
MITRE ATT&CK
DanBot in ATT&CK
19 distinct techniquesTechniques
19 techniques T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols T1204.002 Malicious File T1041 Exfiltration Over C2 Channel T1059.003 Windows Command Shell T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1053.005 Scheduled Task T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1204 User Execution T1053 Scheduled Task/Job T1059.005 Visual Basic T1005 Data from Local System T1027.013 Encrypted/Encoded File T1105 Ingress Tool Transfer T1071.004 DNS T1021.005 VNC
