Milan

MITRE ATT&CK: S1015 View on attack.mitre.org

Aliases: James, Milan

First seen
2020-06-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:56:43

Targeted industries: energy-and-utilities

Context

Milan is a backdoor implant based on DanBot that was written in Visual C++ and .NET. Milan has been used by HEXANE since at least June 2020.

Detection coverage

  • 1 YARA rules
  • 368 Sigma rules

Malware & tools used

  • Scheduled Task (attack-pattern)
  • Local Data Staging (attack-pattern)
  • DNS (attack-pattern)
  • System Information Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Component Object Model (attack-pattern)
  • Web Protocols (attack-pattern)
  • Query Registry (attack-pattern)
  • Masquerading (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Native API (attack-pattern)
  • Data from Local System (attack-pattern)
  • Local Account (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • File Deletion (attack-pattern)
  • Double File Extension (attack-pattern)

Used by threat actors

Detection rules

  • ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 (yara-rule)

Reports & references

  • prevailion.com — Latest Targets Of Cyber Group Lyceum (report)
  • clearskysec.com — Siamesekitten (report)
  • vblocalhost.com — Vb2021 Kayal Etal (report)
  • accenture.com — Iran Based Lyceum Campaigns (report)
  • clearskysec.com — Siamesekitten (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Milan (report)
  • MITRE ATT&CK — S1015 (report)

External references