CyberSIXT Search
Threat actor

Tortoiseshell

Iran · espionage

Tracked by CyberSIXT since 26 Aug

Articles · all time
1
Articles · last 30 days
0
CVEs exploited · attributed · all time
0
Research reports · all time
0

One article so far, 26 Aug. A pattern appears once more outlets cover Tortoiseshell.

1
  1. Tortoiseshell Hackers Add New Backdoor Aimed at Defence SectorInfosecurity

Names and sources

Tortoiseshell
Named by CyberSIXT coverage
CURIUM
Named by Malpedia · tortoiseshell
Crimson Sandstorm
Named by Malpedia · tortoiseshell
Cuboid Sandstorm
Named by Malpedia · tortoiseshell
DUSTYCAVE
Named by Malpedia · tortoiseshell
IMPERIAL KITTEN
Named by Malpedia · tortoiseshell
Smoke Sandstorm
Named by Malpedia · tortoiseshell
TA456
Named by Malpedia · tortoiseshell
All 33 names
Tortoiseshell
Named by Malpedia · tortoiseshell
Yellow Liderc
Named by Malpedia · tortoiseshell
CURIUM
Named by Microsoft · Crimson Sandstorm
Crimson Sandstorm
Named by Microsoft · Crimson Sandstorm
Cuboid Sandstorm
Named by Microsoft · Cuboid Sandstorm
DEV-0228
Named by Microsoft · Cuboid Sandstorm
HOUSEBLEND
Named by Microsoft · Crimson Sandstorm
IMPERIAL KITTEN
Named by Microsoft · Crimson Sandstorm
TA456
Named by Microsoft · Crimson Sandstorm
Tortoise Shell
Named by Microsoft · Crimson Sandstorm
CURIUM
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
Crimson Sandstorm
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
Cuboid Sandstorm
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
DUSTYCAVE
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
IMPERIAL KITTEN
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
Smoke Sandstorm
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
TA456
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
Tortoiseshell
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
Yellow Liderc
Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
CURIUM
Named by MITRE ATT&CK® · G1012
Crimson Sandstorm
Named by MITRE ATT&CK® · G1012
TA456
Named by MITRE ATT&CK® · G1012
Tortoise Shell
Named by MITRE ATT&CK® · G1012
Yellow Liderc
Named by MITRE ATT&CK® · G1012
5f108484-db7f-11e9-aaa4-fb0176425734
Named by CyberSIXT coverage

Attributed facts

category
state (Microsoft · Crimson Sandstorm)
motivation
espionage (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
origin
Iran (Microsoft · Crimson Sandstorm)
origin
Iran (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Civil Society (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Defense (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Energy (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Finance (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Government (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Healthcare (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
High-Tech (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Legal (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Media (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Military (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
NGOs (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Pharmaceuticals (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Rail (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Telecoms (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sector
Transportation (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
sponsor
Iran (Islamic Republic of) (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
Target country
Europe (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
Target country
Israel (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
Target country
Middle East (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
Target country
United States (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)

Malware and tools

IMAPLoader (MITRE ATT&CK® · G1012) IMAPLoader (Malpedia · tortoiseshell) Liderc (Malpedia · tortoiseshell) SysKit (Malpedia · tortoiseshell)

MITRE ATT&CK® techniques

From MITRE ATT&CK® · G1012

Resource Development
T1583.001
Domains
Initial Access
T1189
Drive-by Compromise
T1566.001
Spearphishing Attachment
T1566.003
Spearphishing via Service
Execution
T1059.001
PowerShell
T1204.002
Malicious File
Persistence
T1505.003
Web Shell
Discovery
T1082
System Information Discovery
T1124
System Time Discovery
Collection
T1005
Data from Local System
Exfiltration
T1041
Exfiltration Over C2 Channel
T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Include passing mentions (1)

Coverage

1 article, all timeRSS feed
  1. Tortoiseshell Hackers Add New Backdoor Aimed at Defence SectorInfosecurity · first in our coverage

Related actors

Learn more

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device