SnappyTCP
SnappyTCP is a Linux/Unix malware family described by PwC as a simple reverse TCP shell with basic command-and-control capabilities that is also used to establish persistence on compromised systems. The reporting indicates at least two main variants: one using plaintext communications and another using TLS via OpenSSL and TLS certificates to encrypt traffic. SnappyTCP performs an HTTP-based negotiation before spawning a reverse TCP shell, and its C2 traffic has been described as using HTTP GET requests; reported traffic may include the HTTP header "X-Auth-43245-S-20." The malware has been observed in both executable and shared object formats, compiled for multiple architectures and operating systems, sometimes with statically linked GLIBC, and uses pthreads to spawn bash processes. It can parse configuration files to determine C2 IP addresses. Sea Turtle, also referred to as Teal Kurma, Marbled Dust, and Cosmic Wolf, deployed SnappyTCP during intrusion operations, including as a web shell, and executed it with nohup to keep it running after shell exit. The actor used shell scripts such as upxa.sh to drop executables for C2 communication. Supporting reporting associates SnappyTCP with a Türkiye-nexus espionage actor targeting organizations in Europe, the Middle East, North Africa, and Mediterranean Europe, including government, telecommunications, IT, NGO, media, and other public- and private-sector entities. Reported infrastructure associated with SnappyTCP includes domains such as lo0.systemctl.network, ybcd.tech, alhurra.online, al-marsad.co, and anfturkce.news, and IP addresses including 168.100.10.187, 93.115.22.212, and 108.61.103.186. The actor has also been reported exploiting CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 for initial access in related operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal. Sea Turtle deployed the SnappyTCP web shell during intrusion operations.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 technique
Persistence
Stealth
1 technique
Stealth
Command and Control
4 techniques
Command and Control
The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A web shell used by Sea Turtle during intrusion operations to maintain execution and post-compromise access on victim systems.
SnappyTCP is a simple reverse TCP shell for Linux/Unix systems, used by the Teal Kurma (Sea Turtle) threat actor for remote command execution, persistence, and command and control. It has at least two variants: one using plaintext communication and another using TLS for secure connections. The malware is used for espionage, enabling the threat actor to collect and exfiltrate sensitive data from targeted organizations.
Malware that uses OpenSSL and TLS certificates to encrypt traffic.
Reverse TCP shell/web shell providing C2 and persistence capabilities.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.