Pierluigi Paganini May 25, 2023

Iran-linked threat actor Tortoiseshell targeted shipping, logistics, and financial services companies in Israel with watering hole attacks.

ClearSky Cyber Security uncovered a watering hole attack on at least eight Israeli websites belonging to shipping, logistics, and financial services companies and attributed them with low confidence to the Iran-linked APT group Tortoiseshell (aka TA456 or Imperial Kitten).

The threat actors used a script on the compromised websites to collect preliminary user information.

The malicious JavaScript employed in the watering hole attacks collects data from visitors, including the user’s OS language, IP address, screen resolution, as well as the URL from which the website was visited.

The activity of the APT group was first detailed by Symantec in 2019, the experts analyzed a series of attacks against IT providers in Saudi Arabia and US entities. The expert spotted the Iranian group in 2018, but they speculate that it has been active for a longer time.

Five out of eight compromised websites were hosted by the uPress hosting service, which was hit by a cyber attack carried out by the Iranian group Emennet Pasargad5, “Hackers of Savior”, in 2020.

“uPress”, a hosting service, was attacked in 2020 by the Iranian group Emennet Pasargad5 , “Hackers of Savior”, who defaced thousands of Israeli sites hosted by it.

The collected data were transferred into a JSON file via a POST request to a website under the control of the threat actor.

The experts noticed that the first malicious JavaScript they spotted contains a unique string of text which includes grammatical errors. Looking for this unique string, the researchers were able to find another JavaScript that contains the same code but is used on a different domain.

“The script is downloaded from the malicious website cdnpakage[.]com. Our team discovered that cdnpakage[.]com previously had another SSL certificate related to another domain – globalpneuservices[.]com.” reads the report published by ClearSky. “Using the domain cdnpakage[.]com, additional infected domains were found: tel-bar.co[.]il, aviram.co[.]il.”

The attribution to an Iran-linked APT is based on the following evidence:

• C2 Attribution – The domain jquery-stack[.]online is attributed to TA456 (Tortoiseshell).
• Attackers employed four domains impersonating the legitimate JavaScript framework jQuery
  by using “jQuery” in their domain names. The trick to use domain names impersonating jQuery was observed in a previous Iranian campaign from 2017.
• Watering holes have been part of the initial access stage used by Iran-linked APT since at
  least 2017.
• Iranian threat actors target Israeli websites and attempt to collect data on logistics companies
  associated with shipping and healthcare.
• Re-use of open-source penetration testing tools that focus on web browsers was seen both in
  an Iranian campaign in 2017 and in this current campaign.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Tortoiseshell)