Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/18/2019
07:10 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Saudi IT Providers Hit in Cyber Espionage Operation

Symantec identifies new 'Tortoiseshell' nation-state group as the attackers.

In what appears to be a coordinated and targeted cyber espionage campaign, the networks of several major IT providers in Saudi Arabia were attacked in the past year as a stepping-stone to the attackers' ultimate targets in that region.

Researchers at Symantec say the attackers have been operating since July 2018 and appear to be a previously unidentified threat group, which Symantec has christened Tortoiseshell. The group infiltrated at least 11 organizations, mostly in Saudi Arabia and including large IT providers, employing both off-the-shelf tools and its own custom attack malware. In two of the infected organizations, the attackers obtained domain-level administrative access, so the attackers had access to all machines on those networks.

The researchers say Tortoiseshell does not appear to be related to any existing groups in the Middle East. But one of its victim organizations was infiltrated via a backdoor associated with the Iranian nation-state group Oilrig (aka APT34). Even so, Symantec says there's no confirmed connection that indicates Tortoiseshell is actually Oilrig.

"There's no code overlap or shared infrastructures" with other groups, says Jon DiMaggio, a senior threat intelligence analyst with Symantec. "So we put this activity into its own bucket."

Symantec does not tie specific nations to threat groups unless they've been identified by the US government. 

At a time when many nation-state hacking groups have ditched custom tools and malware for legitimate, off-the-shelf IT tools to remain under the radar, Tortoiseshell bucks the trend a bit with a combination of its own custom backdoor plus some legitimate IT tools such as PowerShell to camouflage its activity. Its Backdoor.Syskit, based on Delphi and .NET, can download and run other tools and tasks.

"My theory is they [nation-states] are primarily going to use whatever tools in the environment they can because it helps them avoid detection. The only reason to create a custom tool is if you need to do something that was present in that environment," DiMaggio says.

Symantec did not identify the targeted industry sector or sectors of the Tortoiseshell victims.

In one interesting twist that's atypical of most targeted attacks, two of the victim networks suffered infections of several hundred machines. "That's noisy for a targeted attack," DiMaggio notes, adding that the attackers may have struggled a bit to get to the actual victim machine they needed, hence the high number of infected machines.

Symantec says the initial attack vector is unknown at this point, but one of the victims may have been hit via a compromised Web server. "For at least one victim, the first indication of malware on their network was a web shell," according to Symantec's threat report on Tortoiseshell, published today. "This indicates that the attackers likely compromised a web server, and then used this to deploy malware onto the network."

The attack steals details about the victim machine, including IP configuration, applications, system information, and network connections.  

John Bambenek, director of cybersecurity research at ThreatStop, says he found the three Syskit backdoor hashes shared by Symantec in the Tortoiseshell report match Yara rules connected to Charming Kitten, aka APT35, an Iranian nation-state group. Charming Kitten is best known for targeting victims in the US, Israel, and the UK who work in the academic research, human rights, and media industries.

It's unclear what the overlap means; nation-stage groups sometimes share or reuse others' tools. And, as Symantec and other security researchers note, attribution gets harder all the time as these groups get more sophisticated.

Bambenek says Iran is likely to continue expanding its cyber espionage and other hacking operations even in the wake of the latest economic sanctions by the US. Cyber operations are relatively inexpensive, he notes.

Meanwhile, Saudi Arabia's oil and gas industry long has been a major cyber target for Iran, starting with its data-destruction attack on Saudi Aramco in 2012, as well as the infamous Shamoon and Triton attacks. The recent drone attacks on Saudi oil facilities, which were attributed to Iran by US officials, have escalated tensions in the Middle East.

Supply Chain for the 'Win'

Supply-chain attacks over the past few years have become a more popular and effective way for nation-states to reach their targeted victims. The number of supply chain attacks jumped 78% in 2018, according to Symantec's data. "IT providers are an ideal target for attackers given their high level of access to their clients' computers. This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines," Symantec said in its report.

"The Tortoiseshell hacks illustrate why IT providers are a classic target for third-party attacks: Such providers have administrative access to numerous customers and many of them lack basic security controls," said Giora Omer, head of security architecture at Panorays, a security-as-a-service firm that provides automated supply chain management.

Tortoiseshell's supply-chain attack method is yet another example of how Iran's cyber espionage machine has matured. Earlier this year, FireEye officially christened an Iranian hacking team it has been tracking for more than four years, as APT39 - the same group of hackers that Symantec already calls Chafer and CrowdStrike calls Helix Kitten. APT39 steals personal information for use in monitoring, tracking, and surveillance operations by the nation.

"They're generally stealing data ... in bulk and then processing it" for usefulness, Benjamin Read, senior manager of cyber espionage analysis at FireEye told Dark Reading in a previous interview

Meantime, a new RAND report released today on nation-state hacking found that Iran is less likely to use cyberattacks for coercion than Russia and North Korea. Instead, Iran is more about retaliation. "Iranian cyber operations appear more focused on retaliating against regional neighbors and the West, rather than serving a direct coercive purpose," the RAND report said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Poll Results: Maybe Not Burned Out, But Definitely 'Well Done'."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20538
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.
CVE-2021-20559
PUBLISHED: 2021-05-10
IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228.
CVE-2021-20577
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
CVE-2021-29501
PUBLISHED: 2021-05-10
Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable...
CVE-2020-13529
PUBLISHED: 2021-05-10
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.