Threat reportAPTTL-2026-3756
Fata Morgana: Watering hole attack on Israeli shipping and logistics websites (Iran-nexus, low-confidence Tortoiseshell/TA456)
Fata Morgana (TL-2026-3756), also tracked as Fata Morgana, is a high-severity advanced persistent threat campaign, first published 2026-10-16. It is attributed to CURIUM - G1012 (Iran) with low confidence, affects Various (Israeli organizations) Compromised public websites (shipping, maps to 6 MITRE ATT&CK techniques (T1036, T1059, T1071), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 1CURIUM - G1012
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3756
- Threat ID
- TL-2026-3756
- Also known as
- Fata Morgana
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- Last reviewed
- Attribution
- CURIUM - G1012
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- shipping, logistics, financial services, transport
- Target regions
- israel
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Fata Morgana
Malware and tooling: Nexus, metasploit
How Fata Morgana works
ClearSky detected a watering hole attack on at least eight Israeli websites, assessed as highly likely orchestrated by an Iranian nation-state actor, with low-confidence attribution to Tortoiseshell (TA456 / Imperial Kitten). Infected sites loaded a script impersonating the jQuery framework from look-alike domains to collect preliminary visitor information.
In May 2023 ClearSky Cyber Security reported the 'Fata Morgana' campaign: at least eight Israeli websites, primarily in shipping, logistics and financial services, were found serving injected JavaScript. Named victims in press coverage include SNY Cargo (freight transport), Depolog (logistics) and SZM (restaurant equipment supplier). Five of the eight infected sites were hosted on the uPress hosting service, which was itself targeted in 2020 by the Iranian group Emennet Pasargad.
The injected code loaded a script from look-alike domains that impersonate the legitimate jQuery framework (e.g. jquery-stack.online, previously attributed to TA456/Tortoiseshell). Impersonating jQuery in domain names is intended to deceive anyone reviewing page source, and the same technique was used in Iranian watering hole campaigns in 2017. The script profiled each visitor and sent the collected data, as a JSON file via a POST request, to a server controlled by the threat actor. Collected parameters were the visitor's IP address, screen resolution, operating system/browser language and the referrer URL (previously visited page). ClearSky assessed that this reconnaissance stage is used to select victims for follow-on targeting. ClearSky also noted code reuse from open-source penetration testing browser tooling (Metasploit-related code with unique strings).
ClearSky attributes the campaign to an Iranian nation-state actor with high likelihood and to Tortoiseshell (TA456, Imperial Kitten) with LOW confidence, based on the jQuery-impersonation technique, the focus on Israeli shipping and logistics (an Iranian interest for roughly three years), and infrastructure overlaps. Tortoiseshell has been active since at least July 2018, when it targeted Saudi Arabian IT providers via supply chain attacks using custom and off-the-shelf malware. By April 18, 2023 malicious code had been removed from most infected sites; investigation was reported as ongoing. Note: no payload stage, hashes or IP addresses were available in the accessible sources; the full ClearSky PDF could not be machine-read, so IOC and TTP detail is limited to what secondary reporting states.
MITRE ATT&CK techniques used in TL-2026-3756
Defense Evasion
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in Fata Morgana
- Various (Israeli organizations) — Compromised public websites (shipping, logistics, financial services); majority hosted on uPress
Remediation for Fata Morgana
Immediate actions
- Block jquery-stack.online, cdnpakage.com and globalpneuservices.com at DNS/proxy and search web proxy logs for requests to them
- Inspect site templates and page source for script tags loading jQuery from non-official domains (code.jquery.com / jquery.com are the legitimate origins)
- Remove injected script tags from compromised sites and rotate hosting/CMS admin credentials
Workarounds
- Self-host jQuery rather than loading it from third-party CDNs
- Treat visitors who loaded the rogue script as potential reconnaissance targets and heighten phishing awareness for those organizations
Longer-term hardening
- Enforce Subresource Integrity and a strict Content-Security-Policy script-src allowlist on public websites
- Monitor third-party script inclusion and file integrity on web properties
- Harden CMS and hosting accounts with MFA and patch plugins/themes promptly
Timeline of Fata Morgana
- Tortoiseshell first observed (July 2018, day approximate), targeting Saudi Arabian IT providers via supply chain attacks
- uPress hosting service targeted by Iranian group Emennet Pasargad, defacing thousands of Israeli sites (2020; month/day approximate)
- Malicious code had been removed from most infected websites by this date, per press reporting of ClearSky findings
- ClearSky Cyber Security reports the Fata Morgana watering hole attack on at least eight Israeli websites
- Press coverage names SNY Cargo, Depolog and SZM among compromised sites and details collected visitor data
- jquery-stack.online first seen per SOCRadar IOC Radar; Security Affairs publishes technical analysis
Sources cited for Fata Morgana
- Fata Morgana: Watering hole attack on shipping and logistics websites
- Fata Morgana - Israeli Websites Infected by Iranian Group (PDF)
- Fata Morgana Watering Hole Attack Targets Shipping, Logistics Firms - Infosecurity Magazine
- Suspected Iranian hackers target Israeli shipping and logistics companies - The Record
- Tortoiseshell behind watering hole attacks on Israeli logistics sites - Security Affairs
- Israeli Shipping, Logistics Companies Targeted in Watering Hole Attacks - Dark Reading
- Сайты логистических компаний Израиля пострадали от кибератаки иранских хакеров - SecurityLab
- SOCRadar IOC Radar: jquery-stack.online
Detection coverage for TL-2026-3756
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3756 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.