Cybersecurity researchers have recently uncovered a watering hole attack that targeted at least eight different websites associated with shipping, logistics, and financial services companies in Israel. The attack, which is believed to have been carried out by an Iranian threat actor tracked as Tortoiseshell, has raised concerns about the continued targeting of Israel by Iranian state-sponsored groups.
A watering hole attack is a type of cyber attack that involves infecting a website that is frequently visited by a targeted group of users or individuals within a specific industry. The goal is to distribute malware to these users when they visit the infected site, essentially poisoning the watering hole that they rely upon for information and resources.
Suspected Iranian threat actor: Tortoiseshell
ClearSky, the Israel-based cybersecurity firm that discovered the recent watering hole attack, has attributed it with low confidence to an Iranian threat actor known as Tortoiseshell. Tortoiseshell has been active since at least July 2018 and has been linked to multiple cyberattacks in the Middle East region. These attacks have included the targeting of IT providers in Saudi Arabia as well as the creation of fake hiring websites for US military veterans.
The goal of these fake websites was to trick veterans into downloading remote access trojans (RATs), which would allow the attackers to gain control of their systems. While these websites were shut down quickly, they demonstrated Tortoiseshell’s ability to create convincing and effective social engineering tactics to achieve its objectives.
Strategic Website Compromises
The attack method used in the recent watering hole attack on Israeli websites is known as strategic website compromise. This attack method involves infecting a commonly-visited website within a specific targeted industry sector with malware.
The idea is that visitors to these sites are more likely to have valuable information that the attackers can exploit. By compromising the website, the attackers can then distribute malware to a large number of visitors, effectively creating a foothold into their targets’ networks.
Malicious JavaScript injected into infected websites
In the case of the recent watering hole attack on Israeli shipping and financial services websites, the attackers injected malicious JavaScript into the sites. This code was designed to collect information about the visitors’ systems and send it back to a remote server for analysis.
The JavaScript code also attempted to determine the user’s language preference, a sign that the attackers were looking to target specific individuals or groups who spoke a particular language. To control the infected sites and continue to collect information, the attackers used a command-and-control (C2) domain named jquery-stack[.]online.
Israel continues to be the target of Iranian hackers
The recent watering hole attack on Israeli shipping and financial services websites is just one of many that have targeted Israeli organizations over the past few years. Iranian state-sponsored hacker groups have been particularly aggressive in targeting Israel, with multiple high-profile attacks aimed at Israeli shipping ports and infrastructure in recent years.
The continued targeting of Israel by Iranian hackers is a concerning trend, indicating that they see Israel as a particularly valuable target for their cyber operations. With the latest watering hole attack, it is clear that Israeli organizations and government agencies need to remain vigilant against these threats and take proactive measures to protect their assets and systems.
In conclusion, the recent watering hole attack on Israeli shipping and financial services websites is a potent reminder of the ongoing threat posed by state-sponsored hacker groups. While the attribution of the attack to Tortoiseshell is uncertain at this stage, the use of strategic website compromises and malicious JavaScript code indicates the involvement of a sophisticated attacker with significant resources and expertise. To protect against such threats, it is essential that organizations remain vigilant, implement security best practices, and stay up-to-date with the latest threat intelligence.