![Dark Reading Global Logo Dark Reading Global Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a6395802cafad0/654e0d60123f32040a075bab/Dark_Reading_Logo_Global_k.png?width=700&auto=webp&quality=80&disable=upscale)
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa.
Imperial Kitten APT Claws at Israeli Industry with Multiyear Spy Effort
The Iran-linked group uses redirected websites to compromise victims and exfiltrate data in a campaign that has lasted over 2022 and 2023.
![Striped cat sitting atop a royal purple cushion wearing a jeweled tiara or crown Striped cat sitting atop a royal purple cushion wearing a jeweled tiara or crown](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf829b9eb0169b17e/654e396b06d55e040a28bbf3/cat.kitten-Fresh_Start_Images-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A group with links to Iran has been conducting watering-hole attacks against Israeli transportation, logistics, and technology sectors over the last two years, an investigation has uncovered.
According to research by CrowdStrike released today, the cyber-espionage attacks were conducted by a state-sponsored advanced persistent threat (APT) named "Imperial Kitten" (aka Yellow Liderc, Tortoiseshell, TA456, and Crimson Sandstorm), which has previously targeted organizations in the Israeli maritime, transportation, and technology sectors. The group has suspected links to Iran's Islamic Revolutionary Guard Corps.
The watering-hole attacks involve what CrowdStrike called "strategic web compromise," where Imperial Kitten has infiltrated legitimate sites in order to redirect website visitors to attacker-controlled locations that phish personal information and credentials. The data is then sent to a hardcoded domain and used for follow-on attacks. The compromised websites were primarily Israeli.
Imperial Kitten targets specific victims, such as IT service providers, for data exfiltration via strategic Web compromise. However, in some instances, the adversary directly serves malware to victims from the watering hole, and has mounted email campaigns involving used malicious Microsoft Excel documents in phishing attacks as another piece of the campaign.
In the latter instance, the group actively uses scanning tools, stolen VPN credentials, and vulnerability exploits to gain access to their targets, then uses the PAExec utility for lateral movement, and finally leverages custom and open source malware for data exfiltration.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024