Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks
Previously undocumented group hits IT providers in the Middle East
A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi
Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers.
This activity indicates the attackers had achieved domain admin level access on these networks, meaning they had access
to all machines on the network.
The group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total
of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations,
evidence suggests that the attackers gained domain admin-level access.
Another notable element of this attack is that, on two of the compromised networks, several hundred computers were
infected with malware. This is an unusually large number of computers to be compromised in a targeted attack. It is
possible that the attackers were forced to infect many machines before finding those that were of most interest to them.
Symantec has seen Tortoiseshell activity as recently as July 2019.
On at least two victim networks, Tortoiseshell deployed its information gathering tools to the Netlogon folder on a
domain controller. This results in the information gathering tools being executed automatically when a client computer
logs into the domain. This activity indicates the attackers had achieved domain admin level access on these networks,
meaning they had access to all machines on the network.
To read the full report please visit https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain.
###