Iran-linked threat actor Tortoiseshell targeted shipping, logistics, and financial services companies in Israel with watering hole attacks.
ClearSky Cyber Security uncovered a watering hole attack on at least eight Israeli websites belonging to shipping, logistics, and financial services companies and attributed them with low confidence to the Iran-linked APT group Tortoiseshell (aka TA456 or Imperial Kitten).
The threat actors used a script on the compromised websites to collect preliminary user information.
The activity of the APT group was first detailed by Symantec in 2019, the experts analyzed a series of attacks against IT providers in Saudi Arabia and US entities. The expert spotted the Iranian group in 2018, but they speculate that it has been active for a longer time.
Five out of eight compromised websites were hosted by the uPress hosting service, which was hit by a cyber attack carried out by the Iranian group Emennet Pasargad5, “Hackers of Savior”, in 2020.
“uPress”, a hosting service, was attacked in 2020 by the Iranian group Emennet Pasargad5 , “Hackers of Savior”, who defaced thousands of Israeli sites hosted by it.
The collected data were transferred into a JSON file via a POST request to a website under the control of the threat actor.
“The script is downloaded from the malicious website cdnpakage[.]com. Our team discovered that cdnpakage[.]com previously had another SSL certificate related to another domain – globalpneuservices[.]com.” reads the report published by ClearSky. “Using the domain cdnpakage[.]com, additional infected domains were found: tel-bar.co[.]il, aviram.co[.]il.”
The attribution to an Iran-linked APT is based on the following evidence:
- C2 Attribution – The domain jquery-stack[.]online is attributed to TA456 (Tortoiseshell).
by using “jQuery” in their domain names. The trick to use domain names impersonating jQuery was observed in a previous Iranian campaign from 2017.
- Watering holes have been part of the initial access stage used by Iran-linked APT since at
- Iranian threat actors target Israeli websites and attempt to collect data on logistics companies
associated with shipping and healthcare.
- Re-use of open-source penetration testing tools that focus on web browsers was seen both in
an Iranian campaign in 2017 and in this current campaign.
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Tortoiseshell)