Threat actor
Tortoiseshell
Iran · espionage
Tracked by CyberSIXT since 26 Aug
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
Names and sources
- Tortoiseshell
- Named by CyberSIXT coverage
- CURIUM
- Named by Malpedia · tortoiseshell
- Crimson Sandstorm
- Named by Malpedia · tortoiseshell
- Cuboid Sandstorm
- Named by Malpedia · tortoiseshell
- DUSTYCAVE
- Named by Malpedia · tortoiseshell
- IMPERIAL KITTEN
- Named by Malpedia · tortoiseshell
- Smoke Sandstorm
- Named by Malpedia · tortoiseshell
- TA456
- Named by Malpedia · tortoiseshell
All 33 names
- Tortoiseshell
- Named by Malpedia · tortoiseshell
- Yellow Liderc
- Named by Malpedia · tortoiseshell
- CURIUM
- Named by Microsoft · Crimson Sandstorm
- Crimson Sandstorm
- Named by Microsoft · Crimson Sandstorm
- Cuboid Sandstorm
- Named by Microsoft · Cuboid Sandstorm
- DEV-0228
- Named by Microsoft · Cuboid Sandstorm
- HOUSEBLEND
- Named by Microsoft · Crimson Sandstorm
- IMPERIAL KITTEN
- Named by Microsoft · Crimson Sandstorm
- TA456
- Named by Microsoft · Crimson Sandstorm
- Tortoise Shell
- Named by Microsoft · Crimson Sandstorm
- CURIUM
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- Crimson Sandstorm
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- Cuboid Sandstorm
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- DUSTYCAVE
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- IMPERIAL KITTEN
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- Smoke Sandstorm
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- TA456
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- Tortoiseshell
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- Yellow Liderc
- Named by MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734
- CURIUM
- Named by MITRE ATT&CK® · G1012
- Crimson Sandstorm
- Named by MITRE ATT&CK® · G1012
- TA456
- Named by MITRE ATT&CK® · G1012
- Tortoise Shell
- Named by MITRE ATT&CK® · G1012
- Yellow Liderc
- Named by MITRE ATT&CK® · G1012
- 5f108484-db7f-11e9-aaa4-fb0176425734
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Crimson Sandstorm)
- motivation
- espionage (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- origin
- Iran (Microsoft · Crimson Sandstorm)
- origin
- Iran (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Civil Society (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Defense (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Energy (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Finance (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Government (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Healthcare (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- High-Tech (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Legal (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Media (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Military (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- NGOs (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Pharmaceuticals (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Rail (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Telecoms (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sector
- Transportation (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- sponsor
- Iran (Islamic Republic of) (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- Target country
- Europe (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- Target country
- Israel (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- Target country
- Middle East (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
- Target country
- United States (MISP Galaxy · 5f108484-db7f-11e9-aaa4-fb0176425734)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1012
Resource Development
- T1583.001
- Domains
Initial Access
Persistence
- T1505.003
- Web Shell
Collection
- T1005
- Data from Local System
Exfiltration
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Tortoiseshell Hackers Add New Backdoor Aimed at Defence SectorInfosecurity
- Iran-Nexus Threat Actor UNC1549 Takes Aim at AerospaceDark Reading · first in our coverage