Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Tortoiseshell · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Tortoiseshell

  • IMPERIAL KITTEN
  • Yellow Liderc
  • Imperial Kitten
  • TA456
  • DUSTYCAVE
  • Crimson Sandstorm
  • Cuboid Sandstorm
  • Smoke Sandstorm

state sponsor · Iran (Islamic Republic of)MITRE G1012 ↗

Tortoiseshell — ATT&CK roseTO

attack rose · 19 techniques across 8 tactics

Analyst brief

misp-galaxy + mitre-attack

A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers. The group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.

Observed targets (as stated by the sources)

2 countries · 15 sectors
United StatesIsraelAssessed origin: Iran

assessed origin · Iranobserved targets · 2

countries · 2

  • United States
  • Israel

sectors · 15

  • Defense
  • Government
  • Military
  • Finance
  • Energy
  • Healthcare
  • Pharmaceuticals
  • Telecoms
  • High-Tech
  • Media
  • NGOs
  • Civil Society
  • Legal
  • Rail
  • Transportation

also stated: Middle East, Europe

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

19 techniques · 8 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    7 techniques

  3. Initial access

    3 techniques

  4. Execution

    2 techniques

  5. Persistence

    1 technique

  6. Discovery

    2 techniques

  7. Collection

    1 technique

  8. Exfiltration

    2 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
IMAPLoaderS1152 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2019Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain AttacksSymantec ↗

Take it with you

keyless · no signup

References

12 sources
  1. 1.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-cha…
  2. 2.darkreading.com/threat-intelligence/iranian-government-hackers-target-…
  3. 3.ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october
  4. 4.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/y…
  5. 5.ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-atta…
  6. 6.services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cy…
  7. 7.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iran…
  8. 8.attack.mitre.org/groups/G1012
  9. 9.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…
  10. 10.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-t…
  11. +2 more in the JSON record

Track Tortoiseshell on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.