Lyceum, a threat group which has historically targeted entities in the telecommunications and energy industries throughout the Middle East, has been seen expanding its targeting to entities in Tunisia. The group, originally documented in 2019, has been extensively targeting several high-profile Tunisian companies involved in aviation and telecommunications. From these attacks, it is apparent that the threat group has been expanding its arsenal of malicious scripts/programs, including a remote access tool dubbed “DanBot”. Two variants of this application have been tied to the group and are referred to as “Kevin” and “James”. Primarily, James is based heavily on the DanBot malware while Kevin is an upgraded application with enhanced architecture and communication protocols. Furthermore, these malware variants allow for Lyceum threat actors to establish a remote command-and-control (C2) connection to their target via HTTP/DNS tunneling, as well as dropping keyloggers onto internal devices to record keystrokes and potentially gain access into internal systems and user accounts. A Russian cybersecurity vendor attributes some Lyceum tactics, techniques and procedures to operations carried out by the “DNSpionage/OilRig/APT34” threat group. CTAPT will continue to monitor the movements of the threat group and provide updates as needed.