From b6ea7157b4e835f26b6bb6300bf57d60eff8b9a0 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Wed, 20 Dec 2023 03:40:25 -0800 Subject: [PATCH] [threat-actors] Add Tortoiseshell aliases --- clusters/threat-actor.json | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 456867f..cc51ce7 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -8536,12 +8536,20 @@ { "description": "A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers.\nThe group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.", "meta": { + "country": "IR", "refs": [ "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain", - "https://www.darkreading.com/threat-intelligence/iranian-government-hackers-target-us-veterans/d/d-id/1335897" + "https://www.darkreading.com/threat-intelligence/iranian-government-hackers-target-us-veterans/d/d-id/1335897", + "https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october", + "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html", + "https://ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-attacks-on-industrial-organizations-in-h1-2023/" ], "synonyms": [ - "IMPERIAL KITTEN" + "IMPERIAL KITTEN", + "Yellow Liderc", + "Imperial Kitten", + "TA456", + "Crimson Sandstorm" ] }, "uuid": "5f108484-db7f-11e9-aaa4-fb0176425734",