At least eight websites associated with shipping, logistics, and financial services companies in Israel were targeted as part of a watering hole attack.
Tel Aviv-based cybersecurity company ClearSky attributed the attacks with low confidence to an Iranian threat actor tracked as Tortoiseshell, which is also called Crimson Sandstorm (previously Curium), Imperial Kitten, and TA456.
“The infected sites collect preliminary user information through a script,” ClearSky said in a technical report published Tuesday. Most of the impacted websites have been stripped of the rogue code.
Tortoiseshell is known to be active since at least July 2018, with early attacks targeting IT providers in Saudi Arabia. It has also been observed setting up fake hiring websites for U.S. military veterans in a bid to trick them into downloading remote access trojans.
That said, this is not the first time Iranian activity clusters have set their sights on the Israeli shipping sector with watering holes.
The attack method, also called strategic website compromises, works by infecting a website that’s known to be commonly visited by a group of users or those within a specific industry to enable the distribution of malware.
In August 2022, an emerging Iranian actor named UNC3890 was attributed to a watering hole hosted on a login page of a legitimate Israeli shipping company that’s designed to transmit preliminary data about the logged-in user to an attacker-controlled domain.
The latest intrusions documented by ClearSky show that the malicious JavaScript injected into the websites functions in a similar manner, collecting information about the system and sending it to a remote server.
Zero Trust + Deception: Learn How to Outsmart Attackers!
Discover how Deception can detect advanced threats, stop lateral movement, and enhance your Zero Trust strategy. Join our insightful webinar!
The JavaScript code further attempts to determine the user’s language preference, which ClearSky said could be “useful to the attacker to customize their attack based on the user’s language.”
On top of that, the attacks also make use of a domain named jquery-stack[.]online for command-and-control (C2). The goal is to fly under the radar by impersonating the legitimate jQuery JavaScript framework.
The development comes as Israel continues to be the most prominent target for Iranian state-sponsored crews. Microsoft, earlier this month, highlighted their new approach of combining “offensive cyber operations with multi-pronged influence operations to fuel geopolitical change in alignment with the regime’s objectives.”