Security News > 2023 > May > Iranian Tortoiseshell Hackers Targeting Israeli Logistics Industry

At least eight websites associated with shipping, logistics, and financial services companies in Israel were targeted as part of a watering hole attack.

Tel Aviv-based cybersecurity company ClearSky attributed the attacks with low confidence to an Iranian threat actor tracked as Tortoiseshell, which is also called Crimson Sandstorm, Imperial Kitten, and TA456.

Tortoiseshell is known to be active since at least July 2018, with early attacks targeting IT providers in Saudi Arabia.

The attack method, also called strategic website compromises, works by infecting a website that's known to be commonly visited by a group of users or those within a specific industry to enable the distribution of malware.

In August 2022, an emerging Iranian actor named UNC3890 was attributed to a watering hole hosted on a login page of a legitimate Israeli shipping company that's designed to transmit preliminary data about the logged-in user to an attacker-controlled domain.

The JavaScript code further attempts to determine the user's language preference, which ClearSky said could be "Useful to the attacker to customize their attack based on the user's language."

News URL

https://thehackernews.com/2023/05/iranian-tortoiseshell-hackers-targeting.html