Loading story…
Facebook said it disrupted the Iran-linked threat actor Tortoiseshell after identifying a broad cyberespionage campaign that used fake personas, spoofed recruiting and job-search sites, and malicious domains impersonating trusted brands to target victims primarily in the United States. The operation focused on military personnel and organizations in the defense and aerospace sectors, with additional targeting in the UK and Europe, and relied on long-term social engineering, phishing, credential theft, and malware delivery through off-platform lures.
Reporting tied the activity to earlier Tortoiseshell operations, including a fake veteran hiring website used to host malware and probable supply-chain attacks against IT providers in Saudi Arabia. Facebook said the group deployed custom tools including the Windows malware Syskit, reconnaissance utilities, keyloggers, and malicious Excel files, including a variant that hid reconnaissance output inside a spreadsheet. The company removed attacker accounts, blocked malicious domains, notified targeted users, and said some malware development was linked to Tehran-based IT firm Mahak Rayan Afraz, which it assessed has ties to the IRGC.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Facebook revealed a previously unreported malicious Excel-embedded tool variant used by Tortoiseshell that stored system reconnaissance output in a hidden area of the spreadsheet. The company said the behavior resembled Cisco's previously identified Liderc reconnaissance tooling.
In the same investigation, Facebook assessed that part of Tortoiseshell's malware development was outsourced to Tehran-based IT company Mahak Rayan Afraz, which it said has ties to the IRGC. Facebook also noted links between some current and former MRA executives and U.S.-sanctioned companies.
Facebook said it disrupted an Iran-linked cyberespionage operation by Tortoiseshell that primarily targeted U.S. military personnel and defense and aerospace organizations, with additional targeting in the UK and Europe. Facebook removed the actors' accounts, blocked malicious domains, notified targeted users, and shared indicators with industry peers.
Proofpoint reported that TA456, overlapping with Tortoiseshell, used the fake persona “Marcella Flores” to build trust with an employee at a small subsidiary of an aerospace defense contractor and in early June 2021 sent a OneDrive link delivering a malicious Excel macro document. The document dropped the VBS-based LEMPO implant, which Proofpoint assessed as an updated Liderc variant used for reconnaissance and data exfiltration.
Cisco Talos reported that Tortoiseshell created a fake veteran hiring website as part of its malware delivery and social-engineering activity. The operation used spoofed employment-themed infrastructure to lure targets.
Symantec published research that Tortoiseshell targeted IT providers in Saudi Arabia in probable supply-chain attacks. The reporting identified a distinct campaign focus on regional service providers as an intrusion vector.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 197 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourceabout.fb.com
Open sourceblog.talosintelligence.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026