Tortoiseshell
Attribution profile
- Type
- Nation State
- Location
- Iran
- Known incidents
- 4 incidents
- Sources
- 5 sources
- First seen
- 2014-01-22
- Last seen
- 2023-04-18
- Updated
- 2026-10-14 20:47
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Imperial Kitten, also known as Islamic Cyber Resistance, TA456 and Tortoiseshell, is an Iran‑based threat actor that has been observed targeting Israeli entities. The group has conducted watering hole attacks against Israeli shipping and logistics firms such as Depolog and SNY Cargo, injecting malicious JavaScript to harvest visitors’ IP addresses, screen resolution, prior URLs and language preferences for future targeting. It has also breached an Israeli job recruitment platform under the #OpSaveGaza banner, leaking personal data of approximately 70,000 users to express support for Palestine, and compromised the official Perl Blogs site to expose 2,924 author credentials in solidarity with the Syria Electronic Army. Observed tactics include compromising frequently visited websites, deploying data‑harvesting scripts, using domains that impersonate legitimate JavaScript frameworks (e.g., jquery‑stack[.]online), and employing both custom and off‑the‑shelf malware in supply chain attacks against IT providers. The activity has been attributed with low confidence to the Iranian nation‑state hacker group Tortoiseshell, indicating a state‑nexus link. Notable campaigns comprise the 2023 Israeli logistics watering hole operation, the 2014 Israeli job site breach, and the 2014 Perl Blogs credential leak.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 5 sources.