From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations
October 29, 2025 · Cybereason · Severity: LOW
Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity.
.png)
Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.
In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity.
Key Takeaways
- Cybereason Security Services investigated the flow of Tangerine Turkey operations.
- The Threat Analysis report covers the group's activities from scripts to systems.
- Practical recommendations are provided for protecting against Tangerine Turkey.