Sea Turtle

Sea Turtle is a Türkiye-nexus threat actor, also tracked as Marbled Dust, SILICON, UNC1326, Cosmic Wolf, Teal Kurma, and Sea Turtle. Public reporting in the provided content describes the group as conducting sophisticated intrusion campaigns centered on DNS hijacking, adversary-in-the-middle operations, credential theft, and long-term access to victim environments. Sea Turtle has targeted third-party entities in trusted relationships with primary targets, including DNS registrars, telecommunication companies, and internet service providers, and has also been reported targeting Kurdish websites in the Netherlands. The group has registered domains for authoritative name servers and command-and-control infrastructure, modified DNS and name server records at service providers to redirect victim traffic, and built adversary-in-the-middle DNS and VPS-based impersonation servers to capture credentials. It has also performed certificate impersonation, including obtaining CA-signed X.509 certificates for the same domain from another provider and installing captured legitimate SSL certificates from victim organizations on Sea Turtle-controlled infrastructure. For initial access, the content states that Sea Turtle used spear phishing, exploitation of public-facing applications, external-facing SSH, abuse of trusted third-party relationships, and compromise of cPanel accounts. It gained access in multiple campaigns by exploiting known vulnerabilities, including CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847. ATT&CK techniques explicitly associated in the content include T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1505.004 IIS Components, T1059 Command and Scripting Interpreter, T1608.001 Upload Malware, and T1608.002 Upload Tool. During post-compromise activity, Sea Turtle used tools such as Adminer to remotely access MySQL services, deployed the SnappyTCP web shell, used Unix shell scripts, downloaded source code and compiled it locally with GCC, and used nohup to keep malware running after shell exit. The actor used HTTP over TCP for command and control, collected and archived victim email data with tar, and staged collected email archives in public web directories accessible from the internet. Defense evasion behavior in the content includes unsetting Bash and MySQL history files and overwriting Linux system logs. The content also states that Sea Turtle used compromised credentials to maintain long-term access to victim environments.