Siamesekitten

Siamesekitten, also known as OilRig, APT34, Lyceum, Crambus, is a cyberespionage group believed to be based in Iran. Active since at least 2014, the group has been implicated in various hacking activities with malicious intent. Siamesekitten's operations have been linked to numerous other threat groups including UNC1860 and Scarred Manticore, demonstrating its significant role in the global cybersecurity landscape. In recent years, Siamesekitten has escalated its activities by targeting Israeli companies in supply chain attack campaigns. These attacks were highlighted by researchers at cybersecurity firm ClearSky, who noted the group's increasing sophistication and tactical evolution. The continued focus on Israeli targets indicates an ongoing geopolitical motivation behind Siamesekitten's operations. Moreover, Siamesekitten has expanded its arsenal of custom malware tools, deploying four new downloaders — SampleCheck5000 (SC5k v1-v3), ODAgent, OilCheck, and OilBooster — within the past year. This development was revealed by ESET researchers, underscoring the group's persistent efforts to enhance its capabilities. The continuous development and deployment of these tools signify the group's intention to remain a formidable threat actor in the realm of cyber espionage.