Tortoiseshell__2019__How_Tortoiseshell_created_a_fake_veteran_hiring_website_to_host_malware.pdf

Cisco Talos details a Tortoiseshell campaign in which a fake veteran employment site called 'Hire Military Heroes' is used to distribute a malware downloader and a modular RAT (IvizTech). The campaign includes a reconnaissance phase that collects extensive host information, uses hard-coded email credentials to exfiltrate data, and relies on a Windows installer with C2 links and service manipulation; multiple IOCs, sample hashes, and infrastructure indicators are provided to aid detection.