TortoiseshellThreat actor
- crimson sandstorm
- cuboid sandstorm
- curium
- dev-0228
- dustycave
- ta456
- tortoise shell
- yellow liderc
A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers. The group, which we are calling Tortoiseshell, has been active since at least July 2018.From MISP Galaxy
Last reported 1 month ago, by Infosecurity Magazine2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“Masquerading as the Windows terminal server SDK DLL (wtsapi32.dll), this backdoor forward-exports all legitimate SDK functions.”
- T1195Supply Chain Compromise
“The group is known for its use of supply chain compromises, watering hole attacks, fake recruitment websites, and custom backdoors, and has been linked to operations supporting Iran’s Islamic Revolutionary Guard Corps (IRGC).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel“Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel”
-
Tortoiseshell: New Toolset and Operational Infrastructure Exposed“Tortoiseshell: New Toolset and Operational Infrastructure Exposed”
Indicators in its reports
named in the reports above- locat[.]sbsin 2 reports
- tiktok-u[.]sbsin 2 reports
- 172.86.98[.]113in 1 report
- 07dd28b748656e9e1a870c538d6df68cin 1 report
- e39bb97415978fa3…20662a51f3abin 1 report
- d23c1b7b917f53e4…cf4a2b0bef4bin 1 report
- db58adc4a6c192520ed509b20a928279in 1 report
- c0dba95939f7fc1a…204f073a981din 1 report
- 597c40e0b23f38f3…3c8f200aa437in 1 report
- neexportfolio[.]comin 1 report
- neexportfolio.azurewebsites[.]netin 1 report
- aecert[.]orgin 1 report
- 185.253.116[.]81in 1 report
- 89.44.80[.]168in 1 report
- 89.44.80[.]234in 1 report
- 185.253.116[.]99in 1 report
- 95.174.68[.]199in 1 report
- 89.44.80[.]6in 1 report
- 185.253.116[.]166in 1 report
- 89.44.80[.]42in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.