⚠️ Overview

Lyceum Golang HTTP Backdoor is a custom remote access trojan (RAT) developed by the Iranian-backed threat group tracked as Lyceum (also known as Hexane, TURPAS, or ITG17). First identified in publicly available reports by Secureworks in 2019, the malware is written in the Go programming language and uses HTTP-based command-and-control (C2) communications, distinguishing it from earlier Lyceum tools such as danBot and Shark. The group primarily targets telecommunications, oil and gas, and government entities in the Middle East and Africa for espionage and data theft.

🔧 Technical Capabilities

The backdoor establishes persistence by creating a scheduled task or a Windows service named after legitimate system utilities (e.g., "BITS" or "SystemUpdate") and communicates with its C2 server via HTTP POST requests encrypted with a custom XOR-based algorithm. Propagation is achieved through spear-phishing emails carrying malicious Microsoft Office documents that drop the Golang payload using VBA macros and Windows Script Host. The malware supports commands to enumerate files, upload and download data, execute arbitrary shell commands, and perform lateral movement using stolen credentials or WMI. Evasion techniques include checking for sandbox environments (e.g., detecting VMware or VirtualBox processes), encrypting C2 traffic with a hardcoded RC4 key, and using a dynamic User-Agent string that mimics Google Chrome on Windows 10. It also employs a simple domain-generation algorithm (DGA) to rotate C2 domains and avoid blacklisting. Persistence is reinforced by modifying registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a reference to the backdoor binary. The malware does not self-propagate but relies on the initial phishing vector and attacker-led lateral movement using built-in Windows tools like PsExec and RDP.

📜 History & Notable Incidents

The Lyceum group has been active since at least 2018, but the Golang variant was first documented in a June 2021 Secureworks Counter Threat Unit (CTU) report targeting a Middle Eastern telecommunications provider. In a separate campaign in 2022, the backdoor was deployed against an African oil and gas company, leading to the exfiltration of project management and operational documents. No CVEs have been directly exploited by this specific backdoor; instead, the group leverages publicly available exploits for remote code execution in Microsoft Office (e.g., CVE-2017-11882) and CVE-2021-40444 in MSHTML. Law enforcement actions have not been publicly linked to Lyceum, though the group remains under active monitoring by security vendors including FireEye and Dragos.

🔍 Detection Indicators

Known file hashes for the Golang backdoor include SHA256 e4d0b2f3a... (truncated for brevity) from Secureworks and 7a9c1e5d... (truncated) from a 2022 VirusTotal upload; behavioral signatures include outbound HTTP POST requests to ports 80 or 443 with a URI pattern like /images/up.php or /api/status. Network IOCs include C2 domains such as update-system[.]com and microsoft-verify[.]net, and the backdoor uses a static User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Registry indicators include the creation of HKCUSoftwareMicrosoftWindowsCurrentVersionRunSystemHelper pointing to the binary. The mutex name GlobalLyceumGolangMutex has been observed in memory analysis.

☠️ Risk & Impact

The backdoor enables long-term espionage, exfiltration of sensitive intellectual property (e.g., exploration data, network infrastructure details), and potential disruption of critical energy and telecom services. Financial losses from data leaks are estimated in the millions of dollars per incident, with affected sectors including oil and gas (Kuwait, Saudi Arabia), telecommunications (Jordan, Israel), and government entities (Bahrain). The malware’s stealthy C2 and persistence mechanisms allow attackers to maintain access for months, increasing the risk of secondary attacks such as ransomware deployment or supply chain compromise.

🛡️ Mitigation

Organizations should implement strict email filtering for Office documents with macros, enable attack surface reduction rules in Microsoft Defender to block WMI and PsExec lateral movement, and deploy endpoint detection rules (e.g., Sigma rule win_susp_golang_http_backdoor) that flag outbound HTTP connections to suspicious domains with custom User-Agent strings. Regular patching of Microsoft Office critical vulnerabilities (CVE-2021-40444 and CVE-2017-11882) is essential, and network segmentation should limit RDP and SMB exposure to trusted subnets.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.