Actors Insights|Latest update09/05/2025

Tortoiseshell

Named by SymantecSuspected state sponsor: Islamic Republic of Iran
First Seen:Jul 2018
Last Seen:May 2023
Indexed Reports:4
Public IOCs:237
Cluster: TortoiseshellMisp: Tortoiseshell
also known as:
Imperial Kitten (CrowdStrike)Yellow Liderc (PWC)TA456 (Proofpoint)DUSTYCAVECrimson Sandstorm (Microsoft)Tortoiseshell (Symantec)

Targeted Regions

Israel
IL
Israel
Israel
May 2022 ~ May 2023
May 2022 ~ May 2023
May 2022 ~ May 2023
May 2022 ~ May 2023
May 2022 ~ May 2023
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jul 2018 ~ Sep 2019
Jul 2018 ~ Sep 2019
Jul 2018 ~ Sep 2019
Jul 2018 ~ Sep 2019
Jul 2018 ~ Sep 2019
United Kingdom
GB
United Kingdom
United Kingdom
Jul 2021 ~ Jul 2021
United States
US
United States
United States
Sep 2019 ~ Sep 2019
Jul 2021 ~ Jul 2021
Jan 2018Sep 2025

Targeted Sectors

LogisticsHealthcareFinancialManufacturingMedicalInformation TechnologyMilitaryDefenseJournalistsAerospace

Recent Indexed Reports

  1. Public
    Tortoiseshell's Cross-Platform Espionage Targets Military and Defense Industries in US, UK, and Europe
  2. Public
    Tortoiseshell Targets U.S. Military Veterans with Malicious Job Seeking Website
  3. Public
    Tortoiseshell Group Targets IT Providers in Saudi Arabia: Supply Chain Attacks Uncovered

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.