Full Report
Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure.
Analysis Summary
# Threat Actor: Tortoiseshell
## Attribution & Identity
* **Name:** Tortoiseshell
* **Known Aliases:** TA456, Imperial Kitten (associated by various industry sources with Iranian interests).
* **Known Associations:** This actor is frequently linked to Iranian state-sponsored operations, though Group-IB focuses on technical infrastructure and malware enrichment in this report.
## Activity Summary
Group-IB performed hunting and enrichment based on public data, leading to the discovery of new samples of a custom .NET backdoor. The activity involves the deployment of modular implants designed for data exfiltration and remote command execution. The actor demonstrates persistence by maintaining redundant C2 infrastructure across different hosting environments (Azure, custom domains).
## Tactics, Techniques & Procedures
* **Dynamic API Resolution:** The malware resolves WinHttp API functions at runtime to establish network connectivity, likely to evade static analysis.
* **Victim ID Generation:** Uses `GetComputerNameExW` to retrieve the fully qualified hostname.
* **Obfuscation:** Employs a specific XOR routine with the repeating key "**Pn**", hex-encoding, and a custom string reversal (trailing two-thirds) to generate unique identifiers.
* **Command Dispatching:** Uses a threaded dispatcher that processes commands separated by a custom delimiter "**@##@**".
* **Multi-Tier C2:** Implements a fallback mechanism where the implant cycles through multiple hardcoded C2 servers if the primary node is unavailable.
* **Execution:** Supports in-memory DLL execution to minimize disk footprint.
**MITRE ATT&CK IDs (Inferred from TTPs):**
* **T1071.001:** Application Layer Protocol: Web Protocols
* **T1059.003:** Command and Scripting Interpreter: Windows Command Shell
* **T1620:** Video Injection / Reflective Code Loading (Execute DLL in memory)
* **T1082:** System Information Discovery
* **T1005:** Data from Local System
## Targeting
* **Sectors:** Historically targets IT providers, shipping, and defense industries.
* **Geography:** Primarily focused on the Middle East (specifically Israel and Saudi Arabia), but infrastructure suggests broader reach.
* **Victims:** Not explicitly named in this snippet, but the malware targets Windows-based enterprise environments via hostnames and domain names.
## Tools & Infrastructure
* **Malware Families:**
* **Tortoiseshell .NET Backdoor:** A custom implant capable of file exfiltration, shell command execution, and directory listing.
* **Infrastructure:**
* **Primary C2 Domain:** `aecert[.]org`
* **Secondary/Redundant C2s:**
* `neexportfolio[.]com`
* `neexportfolio.azurewebsites[.]net`
* `neexportfolio.eastus.cloudapp.azure[.]com`
## Implications
Tortoiseshell continues to evolve its custom tooling to maintain a presence in strategic environments. The use of cloud-native infrastructure (Azure) allows the actor to blend in with legitimate enterprise traffic, making detection more difficult for standard perimeter defenses. Their ability to execute DLLs in memory indicates a sophisticated approach to avoiding traditional antivirus solutions that focus on file-on-disk signatures.
## Mitigations
* **Network Monitoring:** Monitor for unusual HTTPS POST requests containing hex-encoded strings, particularly to uncommon domains or cloud-app subdomains.
* **Endpoint Detection:** Implement EDR rules to flag the use of `GetComputerNameExW` followed by immediate network calls by unsigned or uncommon .NET binaries.
* **In-Memory Inspection:** Utilize memory scanning tools to detect reflective DLL injection or unauthorized code execution within legitimate process memory spaces.
* **Infrastructure Blocking:** Proactively block the identified C2 domains and monitor for DNS resolutions to `*.azurewebsites[.]net` or `*.cloudapp.azure[.]com` that do not align with authorized business applications.