Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

07:10 PM
Connect Directly

Saudi IT Providers Hit in Cyber Espionage Operation

Symantec identifies new 'Tortoiseshell' nation-state group as the attackers.

In what appears to be a coordinated and targeted cyber espionage campaign, the networks of several major IT providers in Saudi Arabia were attacked in the past year as a stepping-stone to the attackers' ultimate targets in that region.

Researchers at Symantec say the attackers have been operating since July 2018 and appear to be a previously unidentified threat group, which Symantec has christened Tortoiseshell. The group infiltrated at least 11 organizations, mostly in Saudi Arabia and including large IT providers, employing both off-the-shelf tools and its own custom attack malware. In two of the infected organizations, the attackers obtained domain-level administrative access, so the attackers had access to all machines on those networks.

The researchers say Tortoiseshell does not appear to be related to any existing groups in the Middle East. But one of its victim organizations was infiltrated via a backdoor associated with the Iranian nation-state group Oilrig (aka APT34). Even so, Symantec says there's no confirmed connection that indicates Tortoiseshell is actually Oilrig.

"There's no code overlap or shared infrastructures" with other groups, says Jon DiMaggio, a senior threat intelligence analyst with Symantec. "So we put this activity into its own bucket."

Symantec does not tie specific nations to threat groups unless they've been identified by the US government. 

At a time when many nation-state hacking groups have ditched custom tools and malware for legitimate, off-the-shelf IT tools to remain under the radar, Tortoiseshell bucks the trend a bit with a combination of its own custom backdoor plus some legitimate IT tools such as PowerShell to camouflage its activity. Its Backdoor.Syskit, based on Delphi and .NET, can download and run other tools and tasks.

"My theory is they [nation-states] are primarily going to use whatever tools in the environment they can because it helps them avoid detection. The only reason to create a custom tool is if you need to do something that was present in that environment," DiMaggio says.

Symantec did not identify the targeted industry sector or sectors of the Tortoiseshell victims.

In one interesting twist that's atypical of most targeted attacks, two of the victim networks suffered infections of several hundred machines. "That's noisy for a targeted attack," DiMaggio notes, adding that the attackers may have struggled a bit to get to the actual victim machine they needed, hence the high number of infected machines.

Symantec says the initial attack vector is unknown at this point, but one of the victims may have been hit via a compromised Web server. "For at least one victim, the first indication of malware on their network was a web shell," according to Symantec's threat report on Tortoiseshell, published today. "This indicates that the attackers likely compromised a web server, and then used this to deploy malware onto the network."

The attack steals details about the victim machine, including IP configuration, applications, system information, and network connections.  

John Bambenek, director of cybersecurity research at ThreatStop, says he found the three Syskit backdoor hashes shared by Symantec in the Tortoiseshell report match Yara rules connected to Charming Kitten, aka APT35, an Iranian nation-state group. Charming Kitten is best known for targeting victims in the US, Israel, and the UK who work in the academic research, human rights, and media industries.

It's unclear what the overlap means; nation-stage groups sometimes share or reuse others' tools. And, as Symantec and other security researchers note, attribution gets harder all the time as these groups get more sophisticated.

Bambenek says Iran is likely to continue expanding its cyber espionage and other hacking operations even in the wake of the latest economic sanctions by the US. Cyber operations are relatively inexpensive, he notes.

Meanwhile, Saudi Arabia's oil and gas industry long has been a major cyber target for Iran, starting with its data-destruction attack on Saudi Aramco in 2012, as well as the infamous Shamoon and Triton attacks. The recent drone attacks on Saudi oil facilities, which were attributed to Iran by US officials, have escalated tensions in the Middle East.

Supply Chain for the 'Win'

Supply-chain attacks over the past few years have become a more popular and effective way for nation-states to reach their targeted victims. The number of supply chain attacks jumped 78% in 2018, according to Symantec's data. "IT providers are an ideal target for attackers given their high level of access to their clients' computers. This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines," Symantec said in its report.

"The Tortoiseshell hacks illustrate why IT providers are a classic target for third-party attacks: Such providers have administrative access to numerous customers and many of them lack basic security controls," said Giora Omer, head of security architecture at Panorays, a security-as-a-service firm that provides automated supply chain management.

Tortoiseshell's supply-chain attack method is yet another example of how Iran's cyber espionage machine has matured. Earlier this year, FireEye officially christened an Iranian hacking team it has been tracking for more than four years, as APT39 - the same group of hackers that Symantec already calls Chafer and CrowdStrike calls Helix Kitten. APT39 steals personal information for use in monitoring, tracking, and surveillance operations by the nation.

"They're generally stealing data ... in bulk and then processing it" for usefulness, Benjamin Read, senior manager of cyber espionage analysis at FireEye told Dark Reading in a previous interview

Meantime, a new RAND report released today on nation-state hacking found that Iran is less likely to use cyberattacks for coercion than Russia and North Korea. Instead, Iran is more about retaliation. "Iranian cyber operations appear more focused on retaliating against regional neighbors and the West, rather than serving a direct coercive purpose," the RAND report said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Poll Results: Maybe Not Burned Out, But Definitely 'Well Done'."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-30
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter.
PUBLISHED: 2020-11-30
Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter.
PUBLISHED: 2020-11-30
An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid=&csppage=cgi_PgOverview&csplang=en is visit...
PUBLISHED: 2020-11-30
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...