Threat reportMalwareTL-2026-3757
Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell Masquerading as Adobe Update
Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell (TL-2026-3757) is a high-severity malware campaign, first published 2026-10-16. It is attributed to Storm-0133 (Iran) with medium confidence, affects Microsoft Windows, maps to 9 MITRE ATT&CK techniques (T1036.001, T1036.005, T1059.005), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 1Storm-0133
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3757
- Threat ID
- TL-2026-3757
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Storm-0133
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- oil and gas, telecoms, aviation, internet service providers
- Target regions
- Middle East, Africa
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell
Malware and tooling: DnsSystem - S1021
How Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell works
ClearSky reports new malware it associates, with medium-high confidence, with the Iranian group SiameseKitten (Lyceum). A reverse shell impersonating an Adobe update is dropped by a parent file signed with a fake Microsoft certificate, alongside a lure PDF about drone attacks in Iran and an executable that establishes persistence.
In a report dated 23 June 2022, ClearSky Cyber Security described a new malware sample that it attributes with medium-high confidence to the Iranian threat group SiameseKitten (also tracked as Lyceum, HEXANE and Spirlin). The payload is a reverse shell, viewPDF.exe, that impersonates an Adobe update and uses an Adobe PDF icon.
The reverse shell is dropped by a parent file (irdrones1.exe, also seen as viewPDF.scr) that carries a fake Microsoft code-signing certificate. Per search-engine excerpts of the ClearSky PDF, the certificate shows a signing date of 08.06.2022, the file's creation date is 25.06.2020, and the reverse shell carries a forged compile timestamp of 29.06.2044, an attempt to evade detection. Alongside the reverse shell, the parent file drops a lure PDF document about drone attacks carried out in Iran, which resembles a lure document SiameseKitten used previously, and an executable that establishes persistence. The reverse shell waits for instructions from the attacker after the parent file executes.
The parent file and reverse shell were downloaded from a domain registered on 6 June 2022. The malware communicates with a previously unknown command-and-control server whose IP address is adjacent to the IP address of that domain, indicating the actor controls at least two IP addresses in the same range. The adjacent range is a useful hunting pivot. ClearSky's domain name and IP addresses could not be retrieved from the page body.
Related activity in the same month: Zscaler documented a June 2022 Lyceum campaign that also used an Iranian-drone lure (ir_drones.docm, a macro-enabled Word document copying text from an RFE/RL report), hosted on news-spot.live, which dropped the .NET DNS backdoor DnsSystem.exe into the Startup folder and used cyberclub.one (DNS C2 at 85.206.175.199). Zscaler does not reference the ClearSky report, so those indicators are recorded as related-campaign context, not confirmed members of the ClearSky sample set.
MITRE tracks the group (G1001) as a cyber-espionage actor active since at least 2017 against oil and gas, telecommunications, aviation and ISP organizations in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco and Tunisia. Its tooling includes DanBot, DnsSystem, Kevin, Milan, Shark, Empire, PoshC2 and Mimikatz. Other Iranian groups, including Phosphorus, have also used fake Microsoft certificates.
LIMITATION: the full ClearSky report body could not be fetched. File names and hashes come from search-result excerpts of the ClearSky PDF and should be re-verified against it.
MITRE ATT&CK techniques used in TL-2026-3757
Defense Evasion
T1036.001 Invalid Code Signature; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp
Execution
T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
Persistence
T1547.001 Registry Run Keys / Startup Folder
Resource Development
Affected products and versions in Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell
- Microsoft — Windows
Remediation for Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell
Immediate actions
- Hunt for viewPDF.exe, viewPDF.scr and irdrones1.exe and for the listed hashes
- Hunt for executables presented as Adobe updates that are not signed by Adobe, or that carry a Microsoft signature that fails validation
- Inspect Startup folders for recently dropped executables
- Block news-spot.live and cyberclub.one and investigate hosts that contacted 85.206.175.199
- Investigate hosts that contacted domains registered on 2022-06-06 or IP addresses adjacent to them
Workarounds
- Restrict write access to user Startup folders where feasible
- Disable Office macros from internet-sourced documents
- Deliver Adobe updates only through managed software distribution
Longer-term hardening
- Enforce full code-signing chain validation (WDAC/AppLocker publisher rules)
- Block newly registered domains at the proxy/DNS layer
- Train staff on topical lure documents (conflict and drone-attack themes)
Timeline of Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell
- MITRE reports the HEXANE/Lyceum group active since at least 2017, targeting oil and gas, telecom, aviation and ISPs in the Middle East and Africa (year-level date)
- ClearSky publishes its earlier SiameseKitten (Lyceum) report on a new Iranian espionage campaign (month-level date)
- Domain used to host the parent file and reverse shell is registered; the sample was also first submitted on June 6th from the United Arab Emirates, per ClearSky excerpts
- Fake Microsoft certificate on the parent file shows a signing date of 08.06.2022 (DD.MM.YYYY, per ClearSky excerpts)
- ClearSky identifies a previously unknown C2 server whose IP is adjacent to the IP of the staging domain
- ClearSky publishes the Lyceum suicide-drone report, attributing the Adobe-update reverse shell to SiameseKitten with medium-high confidence
- Zscaler ThreatLabz publishes the related June 2022 Lyceum drone-lure campaign using ir_drones.docm and the DnsSystem .NET DNS backdoor (day approximate; page dated June 2022)
Sources cited for Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell
- Lyceum suicide drone (ClearSky)
- Lyceum suicide drone 23.6 (ClearSky PDF report)
- Lyceum .NET DNS Backdoor (Zscaler ThreatLabz)
- New Iranian Espionage Campaign By Siamesekitten - Lyceum August 2021 (ClearSky)
- HEXANE, Lyceum, Siamesekitten, Spirlin, Group G1001 (MITRE ATT&CK)
- Threats Feed - Certfa Radar
- Lyceum drone-themed phishbait (CyberWire research briefing)
- Rewterz Threat Alert - Lyceum APT aka HEXANE/Spirlin Active IOCs
Detection coverage for TL-2026-3757
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3757 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.