World Video | Defence | Foreign Affairs | Natural Events | Trade | NZ in World News | NZ National News Video | NZ Regional News | Search

 

Tortoiseshell Group Targets IT Providers in Saudi Arabia

Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

Previously undocumented group hits IT providers in the Middle East

A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers.

This activity indicates the attackers had achieved domain admin level access on these networks, meaning they had access to all machines on the network.

The group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.

Another notable element of this attack is that, on two of the compromised networks, several hundred computers were infected with malware. This is an unusually large number of computers to be compromised in a targeted attack. It is possible that the attackers were forced to infect many machines before finding those that were of most interest to them.

Symantec has seen Tortoiseshell activity as recently as July 2019.

On at least two victim networks, Tortoiseshell deployed its information gathering tools to the Netlogon folder on a domain controller. This results in the information gathering tools being executed automatically when a client computer logs into the domain. This activity indicates the attackers had achieved domain admin level access on these networks, meaning they had access to all machines on the network.

To read the full report please visit https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain.

###


© Scoop Media

 
 
 
World Headlines

 

Gordon Campbell: On The Iran Aftermath

So, evidently, you can get away with murder. It looks as though a further escalation in the ongoing war between Iran and the US has been avoided – mainly thanks to Iran NOT responding in kind to the recklessly unhinged behaviour by the United States. ... More>>

ALSO:

Madrid Climate Talks: Decade Ending 2019 Likely To Be Hottest On Record

“If we do not take urgent climate action now, then we are heading for a temperature increase of more than 3°C by the end of the century, with ever more harmful impacts on human wellbeing.” More>>

ALSO:

Gordon Campbell: On The Recent Upheavals Inside Iran

In the fortnight since the Internet got switched back on in Iran, the ferocity of the crackdown on the recent demonstrations has become evident. Reportedly, hundreds of people have been killed, thousands wounded and thousands more have been arrested. More>>

ALSO: