Tortoiseshell

Tortoiseshell is Symantec's designation for the Iranian threat cluster known as Imperial Kitten, active since at least 2018. The group targets IT managed service providers (MSPs) and supply chain companies to gain downstream access to defense and government networks in the Middle East and the United States. Symantec documented campaigns in which Tortoiseshell compromised IT firms serving Saudi Arabian defense contractors, using custom malware including Sartoruis and Backdoor.Dituran for persistence and data collection. The cluster shares IRGC attribution and targeting patterns with the broader Imperial Kitten, TA456, and Crimson Sandstorm identities.