Threats Feed

The report from Proofpoint outlines a complex social engineering and malware campaign that appears to have been conducted by an actor aligned with the Iranian state, believed to be TA456. Over several years, TA456 used a fake social media persona, "Marcella Flores," to build a relationship with an employee of an aerospace defense contractor. The aim was to infect the target's computer with the LEMPO malware, designed for reconnaissance and data exfiltration. This campaign serves to illustrate TA456's persistence and advanced social engineering tactics, targeting smaller contractors with the ultimate goal of eventually compromising larger defense firms.

Tortoiseshell targeted military personnel and companies in the defense and aerospace industries, primarily in the United States and, to a lesser extent, the UK and Europe. The group used social engineering, phishing, and custom malware tools, including Syskit and a Liderc-like reconnaissance tool, to compromise and profile victims' systems. The campaign involved fake online personas, spoofed domains, and outsourced malware development to Tehran-based IT company Mahak Rayan Afraz (MRA), which has ties to the Islamic Revolutionary Guard Corps (IRGC).

Tortoiseshell deployed a fake website targeting U.S. military veterans seeking jobs. The site tricked users into downloading a malicious app that served as a malware downloader, deploying spying tools and other malware. The fake website had users download a fake installer, which downloaded two binaries: a reconnaissance tool and a Remote Administrative Tool (RAT). The reconnaissance tool collected extensive information about the victim's machine, while the RAT allowed further remote control.