LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1019: Shark

Shark is a backdoor malware written in C# and .NET that is an updated version of Milan; it has been used by HEXANE since at least July 2021.[1][2]

EnterpriseS1019MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Shark matters because it is a Windows C#/.NET backdoor associated in ATT&CK with HEXANE and a behavior set that supports persistence of remote control, discovery, staging, and exfiltration. For leaders, the practical question is not just “do we know this malware name?” but whether Windows endpoint, DNS, web, and data-movement monitoring can show when a backdoor is communicating, collecting local data, hiding artifacts, or moving files out over command-and-control channels.

Executive priority

Prioritize Shark-related readiness where Windows environments support sensitive operations, regulated data, or sectors similar to those noted in the HEXANE relationship, including oil and gas, telecommunications, aviation, and internet service providers. The ATT&CK record has no official detection text, so leadership should ask for evidence of coverage across the mapped behaviors: command shell execution, registry and system discovery, DNS/web C2, fallback channels, data staging, scheduled transfer, and exfiltration over C2. This is useful for incident response planning, SOC validation, compliance evidence, and resilience discussions because the material risk is covert access plus data theft rather than a single malware signature.

Technical view

Treat Shark as a Windows-focused backdoor with ATT&CK relationships spanning execution, discovery, command-and-control, collection, exfiltration, and defense evasion/stealth. SOC and IR teams should validate that endpoint telemetry captures .NET/C# process behavior, child process creation such as Windows command shell use, registry queries, system information discovery, file creation/deletion, encoded or decoded artifacts, and unusual staging directories. Network teams should validate visibility into outbound HTTP/S-style web traffic, DNS activity, DGA-like domain patterns, fallback destinations, tool/file downloads, and data transfer over an established C2 channel. Because ATT&CK provides no official detection guidance for this object, detections should be behavior-based and tested against the related techniques rather than relying on the Shark name alone.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially cmd.exe and suspicious .NET process activity
  • Windows Registry query telemetry
  • System information discovery events from hosts
  • File creation, rename, deletion, encoding/decoding, and staging-location activity
  • DNS query logs and resolver telemetry for unusual or algorithmic-looking domains

Detection direction

  • Build coverage around the mapped ATT&CK behaviors: T1059.003, T1012, T1082, T1071.001, T1071.004, T1008, T1568.002, T1105, T1005, T1074, T1029, and T1041.
  • Correlate endpoint discovery and command shell activity with subsequent outbound DNS/web communications and file staging rather than alerting on isolated benign administrative commands.
  • Tune for false positives from legitimate administration, software inventory, backup jobs, and scheduled data transfers by baselining normal Windows hosts, service accounts, destinations, and timing.
  • Validate visibility into evasive behaviors including encoded/encrypted files, decode/deobfuscation activity, legitimate-looking resource names or locations, file deletion, and system checks that may indicate sandbox or analysis avoidance.
  • Use the HEXANE relationship as threat-intelligence context for prioritization, not as proof of current activity or attribution in a local incident.

Mitigation priorities

  • Start with telemetry assurance: confirm Windows endpoint, DNS, proxy/firewall, and file activity logs are collected, retained, and searchable for incident response.
  • Harden outbound access by enforcing egress controls, DNS monitoring, proxy inspection where appropriate, and alerting for unusual destinations or fallback communication behavior.
  • Reduce command-and-control usefulness through least privilege, application control where feasible, and restrictions on unnecessary script or command shell execution.
  • Protect sensitive data paths with access control, monitoring for staging and bulk movement, and review of scheduled transfer mechanisms.
  • Prepare IR playbooks for suspected backdoor activity: isolate affected Windows hosts, preserve endpoint and network evidence, scope DNS/web communications, and assess possible data collection or exfiltration.
Additional notes and limits

The ATT&CK object identifies Shark as a C#/.NET Windows backdoor and an updated version of Milan, used by HEXANE since at least July 2021. The relationship set is rich enough to guide defensive validation across C2, discovery, collection, exfiltration, and stealth behaviors, but local telemetry is required to determine exposure or activity.

Official detection guidance is not provided. Tactics are not specified on the malware object itself, and several related techniques list platforms beyond Windows; this take treats Windows as the supported Shark platform while using cross-platform technique relationships only as behavioral context. No claim is made about active exploitation, current targeting, attribution in any environment, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Shark

Shark is a backdoor malware written in C# and .NET that is an updated version of Milan; it has been used by HEXANE since at least July 2021.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1105Ingress Tool Transfer

Shark can download additional files from its C2 via HTTP or DNS.[1][2]

EnterpriseT1041Exfiltration Over C2 Channel

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Shark can use encrypted and encoded files for C2 configuration.[1][2]

EnterpriseT1029Scheduled Transfer

Shark can pause C2 communications for a specified time.[1]

EnterpriseT1012Query Registry

Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.[2]

EnterpriseT1082System Information Discovery

Shark can collect the GUID of a targeted machine.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

Shark has the ability to use `CMD` to execute commands.[1][2]

EnterpriseT1008Fallback Channels

Shark can update its configuration to use a different C2 server.[1]

EnterpriseT1005Data from Local System

Shark can upload files to its C2.[1][2]

EnterpriseT1497.001System ChecksSub-technique

Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.[1]

EnterpriseT1070.004File DeletionSub-technique

Shark can delete files downloaded to the compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Shark can extract and decrypt downloaded .zip files.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Shark has the ability to use HTTP in C2 communications.[1][2]

EnterpriseT1071.004DNSSub-technique

Shark can use DNS in C2 communications.[1][2]

EnterpriseT1074Data Staged

Shark has stored information in folders named `U1` and `U2` prior to exfiltration.[1]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

Shark can send DNS C2 communications using a unique domain generation algorithm.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1001: HEXANE

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · GroupG1001: HEXANEEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1074: Data StagedEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
41b1bc9532e8d0de...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle41b1bc9532e8…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  2. [2]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  3. [3]
    Kaspersky Lyceum October 2021

    Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.

    Open source URL
  4. [4]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  5. [5]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  6. [6]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  7. [7]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  8. [8]
    mitre-attackS1019
    Open source URL
  9. [9]
    mitre-attackS1019
    Open source URL
  10. [10]
    mitre-attackS1019
    Open source URL
  11. [11]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  12. [12]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  13. [13]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  14. [14]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  15. [15]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  16. [16]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  17. [17]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  18. [18]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  19. [19]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  20. [20]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  21. [21]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  22. [22]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  23. [23]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  24. [24]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  25. [25]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  26. [26]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  27. [27]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  28. [28]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  29. [29]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  30. [30]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  31. [31]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  32. [32]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  33. [33]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  34. [34]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  35. [35]
    Kaspersky Lyceum October 2021

    Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.

    Open source URL
  36. [36]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  37. [37]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  38. [38]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  39. [39]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  40. [40]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  41. [41]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  42. [42]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  43. [43]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  44. [44]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  45. [45]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  46. [46]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  47. [47]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  48. [48]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  49. [49]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  50. [50]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  51. [51]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  52. [52]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  53. [53]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  54. [54]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  55. [55]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  56. [56]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  57. [57]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  58. [58]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use