- Category
- State · Attributed to a state or working for one.
- Origin
- Türkiye(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G1041 · 27 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0033 · sea-turtle
TürkiyeWhat it is
Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Cosmic Wolf
- Mandiant
- UNC1326
- Microsoft
- Marbled Dust
- Other names
- SILICON, Teal Kurma
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTTürkiye
- MISP Galaxy (CFR tagging)Türkiye
- MicrosoftTürkiye
- ThreatActor.info (Malpedia et al.)Türkiye · high
Targets
- Countries
- Albania, Armenia, Cyprus, Egypt, Germany, Greece, Iraq, Jordan, Lebanon, Libya, Netherlands, Sudan, Sweden, Switzerland, Syria, Türkiye, United Arab Emirates, United States
- Sectors
- Aerospace, Defense, Energy, Government, NGOs, Telecommunications, Think Tanks
Tools
The tools and malware families the sources tie to it.
- CVE-2009-1151
- CVE-2014-6271
- CVE-2017-12617
- CVE-2017-3881
- CVE-2017-6736
- CVE-2018-0296
- CVE-2018-7600
- DNS hijacking
- Drupalgeddon
- SnappyTCP
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de