Iranian Hackers Target Telecoms in Morocco and Middle East, Report Reveals

The hacker group, Lyceum, is said to have intruded into the operating systems of several entities in Morocco between July and October 2021, according to a technical report by researchers from counter-espionage centers, without revealing the identity of the victims.

Active since 2017, Lyceum (alias Hexane or Spirlin) targets strategic sectors of the state, as well as ISPs and government agencies, for the purpose of cyber espionage. With malware and advanced TTPs, the group has managed to launch attacks against two companies in Tunisia, informed the Russian cybersecurity company Kaspersky.

To read: Moroccan Central Bank Alerts Financial Sector to Rising Cybersecurity Threats

The group used malware such as Shark and Milan to obtain account credentials of companies and take control of their information systems and post-exploitation.

"Lyceum will likely continue to use the Shark and Milan software, but with some modifications, as the group has likely been able to maintain its presence in victim networks despite the public disclosure of indicators of compromise associated with its operations," the researchers said.