SiameseKitten

SiameseKitten is an Israeli cybersecurity researchers' designation for the Iranian threat cluster known as Lyceum and HEXANE. Active since at least 2021, the group targets telecommunications and technology companies in Israel and the broader Middle East, deploying custom backdoors including Shark and Milan alongside updated versions of the DanBot toolset. SiameseKitten activity represents a continued evolution of the Lyceum cluster's capabilities and targeting, with a growing focus on Israeli infrastructure consistent with Iranian state adversarial priorities in the region.