Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks

Symantec reports on the Tortoiseshell threat group targeting IT providers in Saudi Arabia via supply-chain style attacks, using the Backdoor.Syskit backdoor along with public tools to gather data and move laterally; at least 11 organizations were affected, some with domain admin access, and several hundred hosts were infected on certain networks, with links to OilRig's Poison Frog observed in one case.