Pierluigi Paganini
May 25, 2023
ClearSky Cyber Security uncovered a watering hole attack on at least eight Israeli websites belonging to shipping, logistics, and financial services companies and attributed them with low confidence to the Iran-linked APT group Tortoiseshell (aka TA456 or Imperial Kitten).
The threat actors used a script on the compromised websites to collect preliminary user information.
The malicious JavaScript employed in the watering hole attacks collects data from visitors, including the user’s OS language, IP address, screen resolution, as well as the URL from which the website was visited.
The activity of the APT group was first detailed by Symantec in 2019, the experts analyzed a series of attacks against IT providers in Saudi Arabia and US entities. The expert spotted the Iranian group in 2018, but they speculate that it has been active for a longer time.
Five out of eight compromised websites were hosted by the uPress hosting service, which was hit by a cyber attack carried out by the Iranian group Emennet Pasargad5, “Hackers of Savior”, in 2020.
“uPress”, a hosting service, was attacked in 2020 by the Iranian group Emennet Pasargad5 , “Hackers of Savior”, who defaced thousands of Israeli sites hosted by it.
The collected data were transferred into a JSON file via a POST request to a website under the control of the threat actor.
The experts noticed that the first malicious JavaScript they spotted contains a unique string of text which includes grammatical errors. Looking for this unique string, the researchers were able to find another JavaScript that contains the same code but is used on a different domain.
“The script is downloaded from the malicious website cdnpakage[.]com. Our team discovered that cdnpakage[.]com previously had another SSL certificate related to another domain – globalpneuservices[.]com.” reads the report published by ClearSky. “Using the domain cdnpakage[.]com, additional infected domains were found: tel-bar.co[.]il, aviram.co[.]il.”
The attribution to an Iran-linked APT is based on the following evidence:
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Tortoiseshell)
