# Lyceum (SiameseKitten) Suicide Drone-Themed Reverse Shell Masquerading as Adobe Update

> ClearSky reports new malware it associates, with medium-high confidence, with the Iranian group SiameseKitten (Lyceum). A reverse shell impersonating an Adobe update is dropped by a parent file signed with a fake Microsoft certificate, alongside a lure PDF about drone attacks in Iran and an executable that establishes persistence.

- **Published:** 2026-10-16T16:23:18Z
- **Last reviewed:** 2026-10-16T16:23:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3757
- **ID:** TL-2026-3757
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Storm-0133 (Iran)
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a report dated 23 June 2022, ClearSky Cyber Security described a new malware sample that it attributes with medium-high confidence to the Iranian threat group SiameseKitten (also tracked as Lyceum, HEXANE and Spirlin). The payload is a reverse shell, viewPDF.exe, that impersonates an Adobe update and uses an Adobe PDF icon.

The reverse shell is dropped by a parent file (irdrones1.exe, also seen as viewPDF.scr) that carries a fake Microsoft code-signing certificate. Per search-engine excerpts of the ClearSky PDF, the certificate shows a signing date of 08.06.2022, the file's creation date is 25.06.2020, and the reverse shell carries a forged compile timestamp of 29.06.2044, an attempt to evade detection. Alongside the reverse shell, the parent file drops a lure PDF document about drone attacks carried out in Iran, which resembles a lure document SiameseKitten used previously, and an executable that establishes persistence. The reverse shell waits for instructions from the attacker after the parent file executes.

The parent file and reverse shell were downloaded from a domain registered on 6 June 2022. The malware communicates with a previously unknown command-and-control server whose IP address is adjacent to the IP address of that domain, indicating the actor controls at least two IP addresses in the same range. The adjacent range is a useful hunting pivot. ClearSky's domain name and IP addresses could not be retrieved from the page body.

Related activity in the same month: Zscaler documented a June 2022 Lyceum campaign that also used an Iranian-drone lure (ir_drones.docm, a macro-enabled Word document copying text from an RFE/RL report), hosted on news-spot.live, which dropped the .NET DNS backdoor DnsSystem.exe into the Startup folder and used cyberclub.one (DNS C2 at 85.206.175.199). Zscaler does not reference the ClearSky report, so those indicators are recorded as related-campaign context, not confirmed members of the ClearSky sample set.

MITRE tracks the group (G1001) as a cyber-espionage actor active since at least 2017 against oil and gas, telecommunications, aviation and ISP organizations in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco and Tunisia. Its tooling includes DanBot, DnsSystem, Kevin, Milan, Shark, Empire, PoshC2 and Mimikatz. Other Iranian groups, including Phosphorus, have also used fake Microsoft certificates.

LIMITATION: the full ClearSky report body could not be fetched. File names and hashes come from search-result excerpts of the ClearSky PDF and should be re-verified against it.

## MITRE ATT&CK

- T1583.001 Domains
- T1587.002 Code Signing Certificates
- T1036.001 Invalid Code Signature
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Timestomp
- T1547.001 Registry Run Keys / Startup Folder
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1071.004 DNS

## Sources

- [Lyceum suicide drone (ClearSky)](https://www.clearskysec.com/lyceum-suicide-drone/)
- [Lyceum suicide drone 23.6 (ClearSky PDF report)](https://www.clearskysec.com/wp-content/uploads/2022/06/Lyceum-suicide-drone-23.6.pdf)
- [Lyceum .NET DNS Backdoor (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor)
- [New Iranian Espionage Campaign By Siamesekitten - Lyceum August 2021 (ClearSky)](https://www.clearskysec.com/siamesekitten/)
- [HEXANE, Lyceum, Siamesekitten, Spirlin, Group G1001 (MITRE ATT&CK)](https://attack.mitre.org/groups/G1001/)
- [Threats Feed - Certfa Radar](https://radar.certfa.com/en/threats/cluster/dbeb25fd/)
- [Lyceum drone-themed phishbait (CyberWire research briefing)](https://thecyberwire.com/newsletters/research-briefing/4/26)
- [Rewterz Threat Alert - Lyceum APT aka HEXANE/Spirlin Active IOCs](https://rewterz.com/rewterz-news/rewterz-threat-alert-lyceum-apt-aka-hexane-spirlin-active-iocs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3757