Tortoiseshell

Tortoiseshell is a prominent threat actor associated with multiple Iranian Advanced Persistent Threat (APT) groups, including MASN. It has been linked to a multi-year cyberattack campaign that targeted over a dozen US companies and government entities, including the Department of the Treasury. The campaign was discovered by Google Cloud's Mandiant and appears to be linked to the Iranian threat group UNC1549, also known as Smoke Sandstorm and Tortoiseshell. This group executes spear phishing and watering-hole attacks for credential harvesting and dropping malware. The activity of this group bears similarities to previous operations attributed to Tortoiseshell, which has been linked to Iran's Islamic Revolutionary Guard Corps (IRGC). In addition to targeting US entities, UNC1549, aka Tortoiseshell, has been active in the Middle East, targeting aerospace and defense firms in Israel, the United Arab Emirates, and other countries in the region. The campaigns are typically customized for each targeted organization, demonstrating a high level of sophistication and strategic planning. In 2021, Facebook took action against a group of Iranian cybercriminals dubbed "Tortoiseshell" by threat researchers at Symantec, who found links to Mahak Rayan Afraz. According to Facebook, Tortoiseshell appeared to have outsourced its malware development, a portion of which it attributed to Nasab’s firm, alleged to have ties to Iran’s Revolutionary Guard Corps. This outsourcing of malware development indicates a significant evolution in the group's modus operandi, suggesting an increased level of complexity and potential threat.