Cyber Threat Alert: Iranian Group Suspected in Watering Hole Attack Targeting Israeli Shipping and Financial Industries

Cybersecurity researchers have recently uncovered a watering hole attack that targeted at least eight different websites associated with shipping, logistics, and financial services companies in Israel. The attack, which is believed to have been carried out by an Iranian threat actor tracked as Tortoiseshell, has raised concerns about the continued targeting of Israel by Iranian state-sponsored groups.

A watering hole attack is a type of cyber attack that involves infecting a website that is frequently visited by a targeted group of users or individuals within a specific industry. The goal is to distribute malware to these users when they visit the infected site, essentially poisoning the watering hole that they rely upon for information and resources.

Suspected Iranian threat actor: Tortoiseshell

ClearSky, the Israel-based cybersecurity firm that discovered the recent watering hole attack, has attributed it with low confidence to an Iranian threat actor known as Tortoiseshell. Tortoiseshell has been active since at least July 2018 and has been linked to multiple cyberattacks in the Middle East region. These attacks have included the targeting of IT providers in Saudi Arabia as well as the creation of fake hiring websites for US military veterans.

The goal of these fake websites was to trick veterans into downloading remote access trojans (RATs), which would allow the attackers to gain control of their systems. While these websites were shut down quickly, they demonstrated Tortoiseshell’s ability to create convincing and effective social engineering tactics to achieve its objectives.

Strategic Website Compromises

The attack method used in the recent watering hole attack on Israeli websites is known as strategic website compromise. This attack method involves infecting a commonly-visited website within a specific targeted industry sector with malware.

The idea is that visitors to these sites are more likely to have valuable information that the attackers can exploit. By compromising the website, the attackers can then distribute malware to a large number of visitors, effectively creating a foothold into their targets’ networks.

Malicious JavaScript injected into infected websites

In the case of the recent watering hole attack on Israeli shipping and financial services websites, the attackers injected malicious JavaScript into the sites. This code was designed to collect information about the visitors’ systems and send it back to a remote server for analysis.

The JavaScript code also attempted to determine the user’s language preference, a sign that the attackers were looking to target specific individuals or groups who spoke a particular language. To control the infected sites and continue to collect information, the attackers used a command-and-control (C2) domain named jquery-stack[.]online.

Israel continues to be the target of Iranian hackers

The recent watering hole attack on Israeli shipping and financial services websites is just one of many that have targeted Israeli organizations over the past few years. Iranian state-sponsored hacker groups have been particularly aggressive in targeting Israel, with multiple high-profile attacks aimed at Israeli shipping ports and infrastructure in recent years.

The continued targeting of Israel by Iranian hackers is a concerning trend, indicating that they see Israel as a particularly valuable target for their cyber operations. With the latest watering hole attack, it is clear that Israeli organizations and government agencies need to remain vigilant against these threats and take proactive measures to protect their assets and systems.

In conclusion, the recent watering hole attack on Israeli shipping and financial services websites is a potent reminder of the ongoing threat posed by state-sponsored hacker groups. While the attribution of the attack to Tortoiseshell is uncertain at this stage, the use of strategic website compromises and malicious JavaScript code indicates the involvement of a sophisticated attacker with significant resources and expertise. To protect against such threats, it is essential that organizations remain vigilant, implement security best practices, and stay up-to-date with the latest threat intelligence.

Explore more

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.

Why Choose IT Operations Over Software Development?

Choosing Between IT Operations and Software Development In today’s rapidly evolving technology landscape, career decisions in the tech field often boil down to choosing between IT operations and software development. While software development is often celebrated for its high salaries and abundance of job opportunities, IT operations offer a compelling alternative that goes beyond financial considerations. The assumption that software

Wix and ActiveCampaign Team Up to Boost Business Engagement

In an era where businesses are seeking efficient digital solutions, the partnership between Wix and ActiveCampaign marks a pivotal moment for enhancing customer engagement. As online commerce evolves, enterprises require robust tools to manage interactions across diverse geographical locations. This alliance combines Wix’s industry-leading website creation and management capabilities with ActiveCampaign’s sophisticated marketing automation platform, promising a comprehensive solution to

Top Cryptocurrencies to Watch in June 2025 for Smart Investments

Cryptocurrencies continue to reshape financial markets and offer intriguing investment opportunities for those astute enough to navigate this rapidly evolving sector. Each month, the crypto landscape introduces new contenders and reinforces existing favorites that demonstrate potential through unique value propositions and market traction. Understanding the intricacies behind these developments is crucial for investors deliberating their next move in the digital