Saudi IT Providers Hit in Cyber Espionage Operation

In what appears to be a coordinated and targeted cyber espionage campaign, the networks of several major IT providers in Saudi Arabia were attacked in the past year as a stepping-stone to the attackers' ultimate targets in that region.

Researchers at Symantec say the attackers have been operating since July 2018 and appear to be a previously unidentified threat group, which Symantec has christened Tortoiseshell. The group infiltrated at least 11 organizations, mostly in Saudi Arabia and including large IT providers, employing both off-the-shelf tools and its own custom attack malware. In two of the infected organizations, the attackers obtained domain-level administrative access, so the attackers had access to all machines on those networks.

The researchers say Tortoiseshell does not appear to be related to any existing groups in the Middle East. But one of its victim organizations was infiltrated via a backdoor associated with the Iranian nation-state group Oilrig (aka APT34). Even so, Symantec says there's no confirmed connection that indicates Tortoiseshell is actually Oilrig.

"There's no code overlap or shared infrastructures" with other groups, says Jon DiMaggio, a senior threat intelligence analyst with Symantec. "So we put this activity into its own bucket."

Symantec does not tie specific nations to threat groups unless they've been identified by the US government. 

At a time when many nation-state hacking groups have ditched custom tools and malware for legitimate, off-the-shelf IT tools to remain under the radar, Tortoiseshell bucks the trend a bit with a combination of its own custom backdoor plus some legitimate IT tools such as PowerShell to camouflage its activity. Its Backdoor.Syskit, based on Delphi and .NET, can download and run other tools and tasks.

"My theory is they [nation-states] are primarily going to use whatever tools in the environment they can because it helps them avoid detection. The only reason to create a custom tool is if you need to do something that was present in that environment," DiMaggio says.

Symantec did not identify the targeted industry sector or sectors of the Tortoiseshell victims.

In one interesting twist that's atypical of most targeted attacks, two of the victim networks suffered infections of several hundred machines. "That's noisy for a targeted attack," DiMaggio notes, adding that the attackers may have struggled a bit to get to the actual victim machine they needed, hence the high number of infected machines.

Symantec says the initial attack vector is unknown at this point, but one of the victims may have been hit via a compromised Web server. "For at least one victim, the first indication of malware on their network was a web shell," according to Symantec's threat report on Tortoiseshell, published today. "This indicates that the attackers likely compromised a web server, and then used this to deploy malware onto the network."

The attack steals details about the victim machine, including IP configuration, applications, system information, and network connections.  

John Bambenek, director of cybersecurity research at ThreatStop, says he found the three Syskit backdoor hashes shared by Symantec in the Tortoiseshell report match Yara rules connected to Charming Kitten, aka APT35, an Iranian nation-state group. Charming Kitten is best known for targeting victims in the US, Israel, and the UK who work in the academic research, human rights, and media industries.

It's unclear what the overlap means; nation-stage groups sometimes share or reuse others' tools. And, as Symantec and other security researchers note, attribution gets harder all the time as these groups get more sophisticated.

Bambenek says Iran is likely to continue expanding its cyber espionage and other hacking operations even in the wake of the latest economic sanctions by the US. Cyber operations are relatively inexpensive, he notes.

Meanwhile, Saudi Arabia's oil and gas industry long has been a major cyber target for Iran, starting with its data-destruction attack on Saudi Aramco in 2012, as well as the infamous Shamoon and Triton attacks. The recent drone attacks on Saudi oil facilities, which were attributed to Iran by US officials, have escalated tensions in the Middle East.

Supply Chain for the 'Win'

Supply-chain attacks over the past few years have become a more popular and effective way for nation-states to reach their targeted victims. The number of supply chain attacks jumped 78% in 2018, according to Symantec's data. "IT providers are an ideal target for attackers given their high level of access to their clients' computers. This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines," Symantec said in its report.

"The Tortoiseshell hacks illustrate why IT providers are a classic target for third-party attacks: Such providers have administrative access to numerous customers and many of them lack basic security controls," said Giora Omer, head of security architecture at Panorays, a security-as-a-service firm that provides automated supply chain management.

Tortoiseshell's supply-chain attack method is yet another example of how Iran's cyber espionage machine has matured. Earlier this year, FireEye officially christened an Iranian hacking team it has been tracking for more than four years, as APT39 - the same group of hackers that Symantec already calls Chafer and CrowdStrike calls Helix Kitten. APT39 steals personal information for use in monitoring, tracking, and surveillance operations by the nation.

"They're generally stealing data ... in bulk and then processing it" for usefulness, Benjamin Read, senior manager of cyber espionage analysis at FireEye told Dark Reading in a previous interview. 

Meantime, a new RAND report released today on nation-state hacking found that Iran is less likely to use cyberattacks for coercion than Russia and North Korea. Instead, Iran is more about retaliation. "Iranian cyber operations appear more focused on retaliating against regional neighbors and the West, rather than serving a direct coercive purpose," the RAND report said.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Poll Results: Maybe Not Burned Out, But Definitely 'Well Done'."