Iran-linked Tortoiseshell APT behind watering hole attacks on shipping and logistics Israeli websites

Iran-linked threat actor Tortoiseshell targeted shipping, logistics, and financial services companies in Israel with watering hole attacks.

ClearSky Cyber Security uncovered a watering hole attack on at least eight Israeli websites belonging to shipping, logistics, and financial services companies and attributed them with low confidence to the Iran-linked APT group Tortoiseshell (aka TA456 or Imperial Kitten).

The threat actors used a script on the compromised websites to collect preliminary user information.

The malicious JavaScript employed in the watering hole attacks collects data from visitors, including the user’s OS language, IP address, screen resolution, as well as the URL from which the website was visited.

The activity of the APT group was first detailed by Symantec in 2019, the experts analyzed a series of attacks against IT providers in Saudi Arabia and US entities. The expert spotted the Iranian group in 2018, but they speculate that it has been active for a longer time.

Five out of eight compromised websites were hosted by the uPress hosting service, which was hit by a cyber attack carried out by the Iranian group Emennet Pasargad5, “Hackers of Savior”, in 2020.

“uPress”, a hosting service, was attacked in 2020 by the Iranian group Emennet Pasargad5 , “Hackers of Savior”, who defaced thousands of Israeli sites hosted by it.

The collected data were transferred into a JSON file via a POST request to a website under the control of the threat actor.

The experts noticed that the first malicious JavaScript they spotted contains a unique string of text which includes grammatical errors. Looking for this unique string, the researchers were able to find another JavaScript that contains the same code but is used on a different domain.

“The script is downloaded from the malicious website cdnpakage[.]com. Our team discovered that cdnpakage[.]com previously had another SSL certificate related to another domain – globalpneuservices[.]com.” reads the report published by ClearSky. “Using the domain cdnpakage[.]com, additional infected domains were found: tel-bar.co[.]il, aviram.co[.]il.”

The attribution to an Iran-linked APT is based on the following evidence:

C2 Attribution – The domain jquery-stack[.]online is attributed to TA456 (Tortoiseshell).
Attackers employed four domains impersonating the legitimate JavaScript framework jQuery
by using “jQuery” in their domain names. The trick to use domain names impersonating jQuery was observed in a previous Iranian campaign from 2017.
Watering holes have been part of the initial access stage used by Iran-linked APT since at
least 2017.
Iranian threat actors target Israeli websites and attempt to collect data on logistics companies
associated with shipping and healthcare.
Re-use of open-source penetration testing tools that focus on web browsers was seen both in
an Iranian campaign in 2017 and in this current campaign.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Tortoiseshell)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.