A nation-state actor believed to be associated with the Tortoiseshell threat organization has conducted several cyber-attacks against Israeli websites. Tortoiseshell, also tracked as Crimson Sandstorm, is an Iran-based APT group conducting malicious activities throughout the Middle East, as well as targeting key United States officials within the government, military, and political atmosphere. One of the group’s most regarded tactics includes the use of detailed personas to lure individuals into social engineering compromises. In this most recent operation, a Tortoiseshell actor targeted eight (8) Israeli-related websites with a watering hole attack, which is a form of attack where websites frequently visited by a group of users are infected with malicious code. These websites reached across several industries including shipping and receiving, financial services, restaurant suppliers, medical, and supply importing. The threat actor was able to inject a block of malicious Javascript code allowing for the passive collection of digital footprint data of visiting users, including the user’s operating system, IP address, screen resolution, and redirection URL. Attribution to the Tortoiseshell group originates with the main typosquatted domain utilized in the attack and the usage of jQuery framework, Metaspolit, and Browser Exploitation Framework Project. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.