Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

07:10 PM
Connect Directly

Saudi IT Providers Hit in Cyber Espionage Operation

Symantec identifies new 'Tortoiseshell' nation-state group as the attackers.

In what appears to be a coordinated and targeted cyber espionage campaign, the networks of several major IT providers in Saudi Arabia were attacked in the past year as a stepping-stone to the attackers' ultimate targets in that region.

Researchers at Symantec say the attackers have been operating since July 2018 and appear to be a previously unidentified threat group, which Symantec has christened Tortoiseshell. The group infiltrated at least 11 organizations, mostly in Saudi Arabia and including large IT providers, employing both off-the-shelf tools and its own custom attack malware. In two of the infected organizations, the attackers obtained domain-level administrative access, so the attackers had access to all machines on those networks.

The researchers say Tortoiseshell does not appear to be related to any existing groups in the Middle East. But one of its victim organizations was infiltrated via a backdoor associated with the Iranian nation-state group Oilrig (aka APT34). Even so, Symantec says there's no confirmed connection that indicates Tortoiseshell is actually Oilrig.

"There's no code overlap or shared infrastructures" with other groups, says Jon DiMaggio, a senior threat intelligence analyst with Symantec. "So we put this activity into its own bucket."

Symantec does not tie specific nations to threat groups unless they've been identified by the US government. 

At a time when many nation-state hacking groups have ditched custom tools and malware for legitimate, off-the-shelf IT tools to remain under the radar, Tortoiseshell bucks the trend a bit with a combination of its own custom backdoor plus some legitimate IT tools such as PowerShell to camouflage its activity. Its Backdoor.Syskit, based on Delphi and .NET, can download and run other tools and tasks.

"My theory is they [nation-states] are primarily going to use whatever tools in the environment they can because it helps them avoid detection. The only reason to create a custom tool is if you need to do something that was present in that environment," DiMaggio says.

Symantec did not identify the targeted industry sector or sectors of the Tortoiseshell victims.

In one interesting twist that's atypical of most targeted attacks, two of the victim networks suffered infections of several hundred machines. "That's noisy for a targeted attack," DiMaggio notes, adding that the attackers may have struggled a bit to get to the actual victim machine they needed, hence the high number of infected machines.

Symantec says the initial attack vector is unknown at this point, but one of the victims may have been hit via a compromised Web server. "For at least one victim, the first indication of malware on their network was a web shell," according to Symantec's threat report on Tortoiseshell, published today. "This indicates that the attackers likely compromised a web server, and then used this to deploy malware onto the network."

The attack steals details about the victim machine, including IP configuration, applications, system information, and network connections.  

John Bambenek, director of cybersecurity research at ThreatStop, says he found the three Syskit backdoor hashes shared by Symantec in the Tortoiseshell report match Yara rules connected to Charming Kitten, aka APT35, an Iranian nation-state group. Charming Kitten is best known for targeting victims in the US, Israel, and the UK who work in the academic research, human rights, and media industries.

It's unclear what the overlap means; nation-stage groups sometimes share or reuse others' tools. And, as Symantec and other security researchers note, attribution gets harder all the time as these groups get more sophisticated.

Bambenek says Iran is likely to continue expanding its cyber espionage and other hacking operations even in the wake of the latest economic sanctions by the US. Cyber operations are relatively inexpensive, he notes.

Meanwhile, Saudi Arabia's oil and gas industry long has been a major cyber target for Iran, starting with its data-destruction attack on Saudi Aramco in 2012, as well as the infamous Shamoon and Triton attacks. The recent drone attacks on Saudi oil facilities, which were attributed to Iran by US officials, have escalated tensions in the Middle East.

Supply Chain for the 'Win'

Supply-chain attacks over the past few years have become a more popular and effective way for nation-states to reach their targeted victims. The number of supply chain attacks jumped 78% in 2018, according to Symantec's data. "IT providers are an ideal target for attackers given their high level of access to their clients' computers. This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines," Symantec said in its report.

"The Tortoiseshell hacks illustrate why IT providers are a classic target for third-party attacks: Such providers have administrative access to numerous customers and many of them lack basic security controls," said Giora Omer, head of security architecture at Panorays, a security-as-a-service firm that provides automated supply chain management.

Tortoiseshell's supply-chain attack method is yet another example of how Iran's cyber espionage machine has matured. Earlier this year, FireEye officially christened an Iranian hacking team it has been tracking for more than four years, as APT39 - the same group of hackers that Symantec already calls Chafer and CrowdStrike calls Helix Kitten. APT39 steals personal information for use in monitoring, tracking, and surveillance operations by the nation.

"They're generally stealing data ... in bulk and then processing it" for usefulness, Benjamin Read, senior manager of cyber espionage analysis at FireEye told Dark Reading in a previous interview

Meantime, a new RAND report released today on nation-state hacking found that Iran is less likely to use cyberattacks for coercion than Russia and North Korea. Instead, Iran is more about retaliation. "Iranian cyber operations appear more focused on retaliating against regional neighbors and the West, rather than serving a direct coercive purpose," the RAND report said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Poll Results: Maybe Not Burned Out, But Definitely 'Well Done'."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-13
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections.
PUBLISHED: 2021-05-13
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with t...
PUBLISHED: 2021-05-13
An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history.
PUBLISHED: 2021-05-13
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "i...
PUBLISHED: 2021-05-13
SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.