Tortoiseshell

Summary

Iranian espionage group tracked by MITRE as CURIUM (G1012) and by vendors as Tortoiseshell (Symantec), TA456 (Proofpoint), Crimson Sandstorm (Microsoft) and Yellow Liderc (PwC). Symantec first reported it in 2019 compromising IT service providers in Saudi Arabia from July 2018, apparently to reach their customers. It is best known for months-long social-media personas: Proofpoint's 'Marcella Flores' persona courted an employee of an aerospace defence subcontractor from 2019 until a June 2021 malware attempt (LEMPO), and Facebook disrupted a network of its fake personas in July 2021, attributing part of the activity to Mahak Rayan Afraz, an IT company with ties to the IRGC. PwC reported watering-hole compromises of Israeli and Mediterranean maritime, shipping and logistics websites in 2022–2023, fingerprinting visitors with injected JavaScript and delivering IMAPLoader, which uses email for command and control. Microsoft maps the vendor name IMPERIAL KITTEN to this group, to Cuboid Sandstorm (DEV-0228) and to UNC1549/Smoke Sandstorm, so 'Imperial Kitten' reporting should not be assumed to mean this record.

Attribution

Via IRGC-tied contractor Mahak Rayan Afraz

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Meta (Facebook) (Research, 2021-07-15)
  Part of its malware was developed by Mahak Rayan Afraz, a Tehran IT firm tied to the IRGC
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Iranian threat group

Campaigns 5

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 3

Infrastructure patterns

• Compromised legitimate websites used for strategic web compromise (watering holes) (MITRE ATT&CK, 2026)
• Email protocols as the data channel: IMAPLoader uses IMAP and SMTPS for C2 and exfiltration (MITRE ATT&CK, 2026)
• OneDrive links for lures; LEMPO sends output from Yandex to a Tutanota mailbox (Proofpoint, 2021)

Reporting and advisories 7

• MITRE ATT&CK
  CURIUM (G1012)
• Symantec
  Tortoiseshell: supply chain attacks on Saudi IT providers
• Proofpoint
  TA456 targets defense contractor with alluring social media persona
• BleepingComputer, reporting PwC
  Yellow Liderc watering holes against Israeli and Mediterranean maritime and logistics websites (IMAPLoader)
• CrowdStrike
  IMPERIAL KITTEN deploys novel malware families (Nov 2023)
• ESET Research
  ESET APT Activity Report Q2–Q3 2026 (Oct 2026)
• Microsoft Threat Intelligence
  How Microsoft names threat actors — naming table (IMPERIAL KITTEN mappings)