Lyceum is an Iranian APT group that has been active since at least 2014. They primarily target Middle Eastern governments and organizations in the ene...

Threat Actor Profile

LYCEUM

State-sponsored threat group originating from IR. Suspected sponsor: Iran (Islamic Republic of). Known to target Government, Energy, High-Tech and 4 other sectors.

7 Industries Tracked Real-Time Alerts

Actor Overview

Origin Country
IR
Suspected Sponsor
Iran (Islamic Republic of)
Incident Types
Espionage

Target Industries

GovernmentEnergyHigh-TechTelecommsEducationMilitaryDefense

Suspected Victims

IsraelMiddle East

Related Threat Reports

Premium
APT Campaign Analysis - Q4 2025Dec 2025
New Tactics Observed in WildDec 2025
Infrastructure Mapping ReportDec 2025
Stay Updated

Get alerts when new intel on LYCEUM is published.

Actor Details

Primary Name
LYCEUM
Known Aliases
COBALT LYCEUM, HEXANE, UNC1530, Spirlin, MYSTICDOME, siamesekitten, Chrono Kitten, Storm-0133
Data Source
Precursor Intelligence
Need API Access?

Integrate threat actor data into your SIEM or SOAR.

View Plans →