Tortoiseshell Group Targets IT Providers in Saudi Arabia: Supply Chain Attacks Uncovered
- Actor Motivations: Espionage,Exfiltration,Sabotage
- Attack Vectors: Code injection,Malware,Supply Chain Compromise
- Attack Complexity: High
- Threat Risk: High Impact/Low Probability
Threat Overview
The Tortoiseshell group has targeted IT providers in Saudi Arabia since at least July 2018, focusing on supply chain attacks to compromise the IT providers' customers. The group deployed both custom and off-the-shelf malware, infecting an unusually large number of computers in targeted attacks. The custom malware, Backdoor.Syskit allowed for downloading and executing additional tools and commands. The attackers used various information-gathering tools, achieving domain admin-level access on at least two organizations, and it is suspected they compromised a web server to deploy malware onto the network.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Information Technology | Verified |
| Region | Saudi Arabia | Verified |
Extracted IOCs
- 02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2
- 07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4
- f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193
- 64[.]235.39.45
- 64[.]235.60.123
Tip: 5 related IOCs (2 IP, 0 domain, 0 URL, 0 email, 3 file hash) to this threat have been found.
About Affiliation
Tortoiseshell
Tortoiseshell is Symantec's designation for the Iranian threat cluster known as Imperial Kitten, active since at least 2018. The group targets IT managed service providers (MSPs) and supply chain companies to gain downstream access to defense and government networks in the Middle East and the United States. Symantec documented campaigns in which Tortoiseshell compromised IT firms serving Saudi Arabian defense contractors, using custom malware including Sartoruis and Backdoor.Dituran for persistence and data collection. The cluster shares IRGC attribution and targeting patterns with the broader Imperial Kitten, TA456, and Crimson Sandstorm identities.
View Tortoiseshell's Insights