IT now stands for Intermediate Targets: Tech providers pwned by snoops eyeing up customers – report

Symantec says Tortoiseshell crew ransacked suppliers

Miscreants are hacking into Saudi Arabian IT providers in an attempt to compromise their real targets: said providers' customers, according to Symantec.

The security software giant said this week its attack investigation team has observed the cyber-gang, dubbed Tortoiseshell, infiltrating the networks of off-premises cloud businesses and tech suppliers in the hope of gaining access to their users, and siphon off data, spy, and do other mischief

Symantec said the hacking crew, active from at least July of last year through July of this year, compromised hundreds of computers within 11 service providers, and exploited this high level of access to menace its actual targets.

"This is an unusually large number of computers to be compromised in a targeted attack," Symantec said in a summary on Wednesday.

"It is possible that the attackers were forced to infect many machines before finding those that were of most interest to them."

The operation is a highly effective new spin on the supply-chain attack concept, in which a crook uses a partner company as the point of entry to a target's network.

china hacking

Hey China, while you're in all our servers, can you fix these support tickets? IBM, HPE, Tata CS, Fujitsu, NTT and their customers pwned


"IT providers are an ideal target for attackers given their high level of access to their clients’ computers," Symantec noted.

"This access may give them the ability to send malicious software updates to target machines, and may even provide them with remote access to customer machines."

It also makes detection of an incoming threat by the targets themselves nearly impossible until it is too late. In at least two of the cases, the hackers ended up being able to navigate the provider's network with domain admin clearance, we're told.

This means the snoops would be able to not only access everything on the IT provider's network, but also create additional accounts and remotely control machines, potentially.

The Symantec team noted the attackers used some of the same malware as the Iran-based OilRig cyber-espionage group, though we've been cautioned against drawing any connections, as those tools have been in the public domain since they were leaked in April.

Because it was the service providers that were infected, Symantec can't say who the ultimate targets were, and there is of yet no way to definitively connect the attack to any group or nation. ®

Keep Reading

Tech Resources

How backup modernization changes the ransomware game

If the thrill of backing up your data and wondering if you will ever see it again has worn off, start the new year by getting rid of the lingering pain of legacy backup. Bipul Sinha, CEO of the Cloud Data Management Company, Rubrik, and Miguel Zatarain, Director of Global Infrastructure Technology at PACCAR, Fortune 500 manufacturer of trucks and Rubrik customer, are talking to the Reg’s Tim Phillips about how to eliminate the costly, slow and spotty performance of legacy backup, and how to modernize your implementation in 2021 to make your business more resilient.

The State of Application Security 2020

Forrester analyzed the state of application security in 2020 and found over 75% of external attacks are attributed to web application and software exploits.

Webcast Slide Deck | Three reasons you need a hybrid multicloud

Businesses need their IT teams to operate applications and data in a hybrid environment spanning on-premises private and public clouds. But this poses many challenges, such as managing complex networking, re-architecting applications for the cloud, and managing multiple infrastructure silos. There is a pressing need for a single platform that addresses these challenges - a hybrid multicloud built for the digital innovation era. Just this Regcast to find out: Why hybrid multicloud is the ideal path to accelerate cloud migration.

Top 20 Private Cloud Questions Answered

Download this asset for straight answers to your top private cloud questions.

Biting the hand that feeds IT © 1998–2021