HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1586.002|Email Accounts|

HEXANE has used compromised accounts to send spearphishing emails.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

HEXANE has used brute force attacks to compromise valid credentials.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

HEXANE has used password spraying attacks to obtain valid credentials.(Citation: SecureWorks August 2019)|