New TortoiseShell Group Hacks 11 IT Providers to Reach Their Customers

mood · Sep 18, 2019

New TortoiseShell Group Hacks 11 IT Providers to Reach Their Customers
September 18, 2019
https://www.bleepingcomputer.com/ne...cks-11-it-providers-to-reach-their-customers/

A newly discovered threat group that security researchers call TortoiseShell is compromising IT providers in what seems to be supply-chain attacks intended to reach the network of specific customers.
The earliest sign of activity from the actor has been tracked to July 2018, although it is possible that it has been operating for a longer time. The most recent time the threat group was seen active is two months ago, in July.
Group uses custom malware and public tools
Security researchers at Symantec identified 11 organizations that had been hit by TortoiseShell. Most of the targets are based in Saudi Arabia and in at least two cases there are enough clues to conclude that the attacker had privileges of a domain administrator, which come with access to all systems on the network.

With two of the victims, TortoiseShell infected hundreds of hosts, likely because they needed to find the machines that were of interest, the researchers say.

"This is an unusually large number of computers to be compromised in a targeted attack," Symantec says in a report published today.
The researchers say that the group relies on both custom and ready-made malware for their operations. One threat TrotoiseShell uses is the Syskit trojan, a custom backdoor discovered on August 21.
Click to expand...

Symantec: Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

Log in or Sign up

New TortoiseShell Group Hacks 11 IT Providers to Reach Their Customers

mood Updates Team