# Fata Morgana: Watering hole attack on shipping and logistics # websites Introduction ClearSky Cyber Security has detected a watering hole attack on at least eight Israeli websites. The attack is highly likely to be orchestrated by a nation-state actor from Iran, with a low confidence specific attribution to Tortoiseshell (also called TA456 or Imperial Kitten). The Infected sites collect preliminary user information through a script. We have discovered several details that suggest this script is used for malicious purposes. In watering hole attacks, the attacker compromises a website that is frequently visited by a specific group of people, such as government officials, journalists, or corporate executives. Once compromised, the attacker can inject malicious code to the website which will be executed when users visit it. Currently, the campaign focuses on shipping and logistics companies, aligning with Iran’s focus on the sector for the past three years. We conclude that the script is malicious based on the following points: - C2 Attribution -The domain jquery-stack[.]online is attributed to TA456 (Tortoiseshell). - Known iranian TTP - Watering hole attacks have been part of the initial access stage used by Iranian threat actors since 2017. [1] This initial access technique was also mentioned by Mandiant [2] in August 2022, where an Iranian threat actor named UNC3890 was targeting shipping companies in Israel using the same watering hole attack. In the current attack, visiting user data is collected and sent to the attacker’s C2 server. - Usage of “jQuery” - Our team observed four domains impersonating jQuery, a legitimate JavaScript framework, by using "jQuery" in their domain names. This is done to deceive anyone who checks the website code. We have already seen domain names impersonating jQuery in a previous Iranian campaign from 2017 using a watering hole attack. The following domain names were used: jguery[.]net, jguery[.]online. In the recent attack there was a use of similar domain names for example: jguery[.]org. - Usage of open source tools - The reuse of open-source penetration test tools that focus on web browsers. In 2017, we reported the Iranian attacker used BeFF (the Browser Exploitation Framework Project), whereas in this case, the attacker used code taken partly from Metasploit framework [3,] with a few added unique strings. According to one of the victims, the JavaScript found in this research is unknown to them, indicating that the script is malicious. Previous Toroiseshell attacks have been observed using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appeared to be supply chain attacks with the end goal of compromising the IT providers' customers. The threat actor has been active since at least July 2018.[4] 1 clearskysec.com/copykitten-jpost/ 2 mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping 3 clearskysec.com/copykitten-jpost/ 4 malpedia.caad.fkie.fraunhofer.de/actor/tortoiseshell © 2023 All rights reserved to ClearSky Security Ltd ----- All eight websites detected by ClearSky analysts were infected by the same method using a similar JavaScript. One of the infected websites, szm.co[.]il had already been classified as infected by ClearSky back in May 2022, and was attributed to an unknown Iranian attacker. List of websites suspected of being infected (based on scans on 18/04/23). Most sites were already cleared of this code: Hosting Related Malicious Victim IP Industry Company Domain sagaselect-am[.]com 68[.]183.241.30 Digital Financial cdn-code-jquery[.]info Ocean Services aviram.co[.]il 88[.]218.117.143 uPress Shipping cdnpakage.com sny-cargo[.]com 185[.]201.148.103 uPress Shipping cdnpakage[.]com szm.co[.]il 185[.]201.148.67 uPress Kitchens jquery-stack[.]online and (Related to restaurants Tortoiseshell)/ Supply jquery-code download[.]online tel-bar.co[.]il 88[.]218.117.143 uPress Medical cdnpakage[.]com azma.co[.]il 88[.]218.117.143 uPress Importing cdnpakage[.]com and marketing depolog.co].[il 62[.]219.78.161 Bezeq Shipping - jquery-codeInternational Logistics download[.]online Ltd. Offe.co[.]il 62[.]219.58.182 Bezeq Supply jguery[.]org International Ltd. “uPress”, a hosting service, was attacked in 2020 by the Iranian group Emennet Pasargad[5], “Hackers of Savior”, who defaced thousands of Israeli sites hosted by it.[6] Research Details In May 2022, ClearSky analysts exposed a watering hole on szm.co[.]il. According to our research, this watering hole was created by an Iranian threat actor. Further research led to the exposure of several additional websites that were infected by a watering hole orchestrated by the same Iranian threat actor. The malicious JavaScript used in the watering hole collects data from visiting users. The data collected includes the user's OS language, IP address, screen resolution, as well as the URL from which the website was visited. 5 ic3.gov/Media/News/2022/221020.pdf 6 zdnet.com/article/thousands-of-israeli-sites-defaced-with-code-seeking-permission-to-access-userswebcams/ © 2023 All rights reserved to ClearSky Security Ltd |leared of this code:|Col2|Col3|Col4|Col5| |---|---|---|---|---| |Victim|IP|Hosting Company|Industry|Related Malicious Domain| |sagaselect-am[.]com|68[.]183.241.30|Digital Ocean|Financial Services|cdn-code-jquery[.]info| |aviram.co[.]il|88[.]218.117.143|uPress|Shipping|cdnpakage.com| |sny-cargo[.]com|185[.]201.148.103|uPress|Shipping|cdnpakage[.]com| |szm.co[.]il|185[.]201.148.67|uPress|Kitchens and restaurants Supply|jquery-stack[.]online (Related to Tortoiseshell)/ jquery-code- download[.]online| |tel-bar.co[.]il|88[.]218.117.143|uPress|Medical|cdnpakage[.]com| |azma.co[.]il|88[.]218.117.143|uPress|Importing and marketing|cdnpakage[.]com| |depolog.co].[il|62[.]219.78.161|Bezeq International Ltd.|Shipping - Logistics|jquery-code- download[.]online| |Offe.co[.]il|62[.]219.58.182|Bezeq International Ltd.|Supply|jguery[.]org| ----- The collected data was trasferred as a JSON file by a POST request to a website controlled by the attacker. Below is an example of one of the scripts found containing the domain jquery-stack[.]online: Sample of the JavaScript code The malicious JavaScript contains a unique string of text which features grammatical errors. Based on this unique string, our team was able to find another JavaScript that contains the same code but a different domain. Our research found a JavaScript that shares the same code with different C2 domains on VirusTotal. File name: addawdawdwdad File type: Win32 EXE Sha256: ef03bd18ca636be5ac23deb16a5a5821a647410c67b5ee33907f768f00f019bb Sha1: c4244269f7c31c9a2bab7cabd568a1cda392ae74 Md5: c3b47295bf32808551478963ac5e5195 The script is downloaded from the malicious website cdnpakage[.]com Our team discovered that cdnpakage[.]com previously had another SSL certificate related to another domain - globalpneuservices[.]com. Using the domain cdnpakage[.]com, additional infected domains were found: tel-bar.co[.]il, aviram.co[.]il. © 2023 All rights reserved to ClearSky Security Ltd ----- Analysis of the Script This script appears to be designed to collect information about the user's system and send it to a remote server. It begins by declaring variables for an object and an array called ips. The function getLang() checks if the navigator.languages property is defined, and if so, returns the first language in the array. If navigator.languages is not defined, it returns navigator.language. The SendCall() function uses jQuery's $.ajax() method to make a POST request to a remote server at the url "https://cdnpakage.com/Info". The data sent with the request includes several pieces of information encoded using base64: "object": encoded current date as a string. "rnamespace": encoded pathname of the current page. "Trigger": encoded result of getLang() function call. "Handler": encoded screen resolution as a string. "nonce": encoded referrer. "DOMParser": always set to "MQ==", which is the base64 encoding of the string "1". "restApi": encoded list of plugin names. "ECO": encoded list of IP addresses obtained through a WebRTC STUN request. "hashCanvas": SHA-256 hash of an HTML canvas element that is generated within the script. The hashCanvas variable is determined by generating an HTML canvas element and drawing some shapes to it. If an error occurs while creating the canvas, hashCanvas is set to the string "noting !". Otherwise, the SHA-256 hash of the canvas image data is computed and used as the value of hashCanvas. The RealIPV() function attempts to obtain the user's IP address by creating a WebRTC peer connection and gathering ICE candidates. Any candidates that match an IP address pattern are added to the ips array. Finally, RealIPV() and SendCall() functions are called at the bottom of the script to gather information and send it to the remote server. The site hXXps://cdnpakage[.]com/Info is indeed malicious, indicating that this script can be used as part of a watering hole attack. Further analysis of the script The provided script appears to be a part of a watering hole attack, attempting to compromise visitors of the infected website by collecting information about their system and then sending it to a remote server controlled by the attacker. Starting with the variables, the "obj" variable is not used in the script yet. The "ips" variable is an empty array, which will later be populated with the user's IP addresses. var obj; var ips = []; var hashCanvas; Here, three variables are declared: obj, ips, and hashCanvas. Their values are not set at this point. © 2023 All rights reserved to ClearSky Security Ltd ----- The code initializes an empty array called "ips" and then uses the window.location object to retrieve the visitor’s IP address. It then checks if the IP address already exists in the "ips" array, and if it does not, it adds the IP address to the array using the push() method. The "getLang()" function attempts to determine the user's language preference by checking the "navigator.languages" array first, and if it's undefined, returning the "navigator.language" property. This information could be useful to the attacker to customize their attack based on the user's language. function getLang() { if (navigator.languages != undefined) return navigator.languages[0]; return navigator.language; } This function returns the user's preferred language for displaying content in their browser. It first checks if the navigator.languages array is defined and returns the first language in the array. If it's not defined, it returns to the navigator.language property. The next function is: function SendCall(){ var x=navigator.plugins.length; var pluggin = [] for(var i=0;i