From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations
October 29, 2025 · Cybereason · Severity: LOW
Cybereason researchers uncovered a cryptomining campaign orchestrated by the threat actor Tangerine Turkey, which spreads via a Visual Basic Script (VBS) worm. The malware targets systems to deploy cryptocurrency miners, hijacking computing resources for financial gain. The attack was detected using Cybereason’s EDR (Endpoint Detection and Response) platform, which tracked the worm’s propagation and payload delivery. The campaign highlights the growing trend of attackers leveraging simple scripts to automate malicious activities at scale. Tangerine Turkey’s operations demonstrate how low-complexity threats can still cause significant damage by exploiting unpatched systems or weak security controls. Organizations are advised to monitor script-based activity, apply patches, and deploy behavioral detection tools to mitigate such threats. Cybereason’s report provides actionable recommendations to defend against similar attacks.
.png)
Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.
In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity.
Key Takeaways
- Cybereason reports on advanced persistent threat activity that organizations in targeted sectors should prioritize for defense.
- State-sponsored threat actors continue to refine their tradecraft, making detection and attribution increasingly complex.
- Threat intelligence sharing and proactive hunting are essential for defending against sophisticated APT campaigns.