LeeryTurtleThreatReport_05_20.pdf (3 MB)

The Leery Turtle report profiles a financially motivated APT active since at least late 2017 against cryptocurrency exchange businesses worldwide. The group performs reconnaissance against technical and executive staff, sends decoy emails with benign attachments to identify likely openers, then uses spear-phishing that impersonates services such as Google Drive and OneDrive and spoofs coworker email identities. A typical attack delivers a password-protected PDF with an LNK shortcut disguised as the password file; the shortcut launches mshta to retrieve VBS payloads from attacker infrastructure, gather host information, and install persistence through a Startup-folder shortcut. The campaign relies on staged VBS downloaders, bit.ly redirection, server-side checks for MSHTA user agents, and C2 responses that deliver second-stage scripts.