# Fata Morgana: Watering hole attack on Israeli shipping and logistics websites (Iran-nexus, low-confidence Tortoiseshell/TA456)

> ClearSky detected a watering hole attack on at least eight Israeli websites, assessed as highly likely orchestrated by an Iranian nation-state actor, with low-confidence attribution to Tortoiseshell (TA456 / Imperial Kitten). Infected sites loaded a script impersonating the jQuery framework from look-alike domains to collect preliminary visitor information.

- **Published:** 2026-10-16T16:07:21Z
- **Last reviewed:** 2026-10-16T16:07:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3756
- **ID:** TL-2026-3756
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** CURIUM - G1012 (Iran)
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2023 ClearSky Cyber Security reported the 'Fata Morgana' campaign: at least eight Israeli websites, primarily in shipping, logistics and financial services, were found serving injected JavaScript. Named victims in press coverage include SNY Cargo (freight transport), Depolog (logistics) and SZM (restaurant equipment supplier). Five of the eight infected sites were hosted on the uPress hosting service, which was itself targeted in 2020 by the Iranian group Emennet Pasargad.

The injected code loaded a script from look-alike domains that impersonate the legitimate jQuery framework (e.g. jquery-stack.online, previously attributed to TA456/Tortoiseshell). Impersonating jQuery in domain names is intended to deceive anyone reviewing page source, and the same technique was used in Iranian watering hole campaigns in 2017. The script profiled each visitor and sent the collected data, as a JSON file via a POST request, to a server controlled by the threat actor. Collected parameters were the visitor's IP address, screen resolution, operating system/browser language and the referrer URL (previously visited page). ClearSky assessed that this reconnaissance stage is used to select victims for follow-on targeting. ClearSky also noted code reuse from open-source penetration testing browser tooling (Metasploit-related code with unique strings).

ClearSky attributes the campaign to an Iranian nation-state actor with high likelihood and to Tortoiseshell (TA456, Imperial Kitten) with LOW confidence, based on the jQuery-impersonation technique, the focus on Israeli shipping and logistics (an Iranian interest for roughly three years), and infrastructure overlaps. Tortoiseshell has been active since at least July 2018, when it targeted Saudi Arabian IT providers via supply chain attacks using custom and off-the-shelf malware. By April 18, 2023 malicious code had been removed from most infected sites; investigation was reported as ongoing. Note: no payload stage, hashes or IP addresses were available in the accessible sources; the full ClearSky PDF could not be machine-read, so IOC and TTP detail is limited to what secondary reporting states.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1059 Command and Scripting Interpreter
- T1036 Masquerading
- T1592 Gather Victim Host Information
- T1071 Application Layer Protocol

## Sources

- [Fata Morgana: Watering hole attack on shipping and logistics websites](https://www.clearskysec.com/fata-morgana/)
- [Fata Morgana - Israeli Websites Infected by Iranian Group (PDF)](https://www.clearskysec.com/wp-content/uploads/2023/05/Fata-Morgana-Israeli-Websites-Infected-by-Iranian-Group-1.8.pdf)
- [Fata Morgana Watering Hole Attack Targets Shipping, Logistics Firms - Infosecurity Magazine](https://www.infosecurity-magazine.com/news/fata-morgana-watering-hole-attacks/)
- [Suspected Iranian hackers target Israeli shipping and logistics companies - The Record](https://therecord.media/israel-shipping-logistics-watering-hole-cyberattacks)
- [Tortoiseshell behind watering hole attacks on Israeli logistics sites - Security Affairs](https://securityaffairs.com/146625/apt/iranian-tortoiseshell-israeli-logistics-industry.html)
- [Israeli Shipping, Logistics Companies Targeted in Watering Hole Attacks - Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/israeli-shipping-logistics-companies-targeted-in-watering-hole-attacks)
- [Сайты логистических компаний Израиля пострадали от кибератаки иранских хакеров - SecurityLab](https://www.securitylab.ru/news/538407.php)
- [SOCRadar IOC Radar: jquery-stack.online](https://socradar.io/free-tools/ioc-radar/jquery-stack.online)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3756