ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
Tortoiseshell
0 incidentes
0 paises
0 sectores
apt IR Ultimo: -
Aliases: CURIUM, Crimson Sandstorm, Cuboid Sandstorm, DUSTYCAVE, IMPERIAL KITTEN, Imperial Kitten, Smoke Sandstorm, TA456, Yellow Liderc, DEV-0228, crimson sandstorm, imperial kitten, ta456, yellow liderc
Tortoiseshell is an Iranian cyber-espionage threat actor that first came to public attention in 2019, though its activity dates back to at least July 2018, initially targeting IT providers in Saudi Arabia through supply chain attacks. The group is assessed with high confidence to be backed by Iran's Islamic Revolutionary Guard Corps (IRGC) and its primary motivation is state-sponsored intelligence gathering. Tortoiseshell distinguishes itself through its patient and prolonged social engineering campaigns, often using fake social media personas to build trust over several weeks or months before delivering malware, and by leveraging supply chain compromises of IT service providers to access their customers. The group operates under several aliases, including CURIUM, Crimson Sandstorm, DUSTYCAVE, IMPERIAL KITTEN, TA456, and Yellow Liderc.