Teal Kurma

Sea Turtle, also tracked as Teal Kurma, Marbled Dust, and Cosmic Wolf, is a highly capable Türkiye-nexus espionage threat actor focused primarily on targets in Europe, the Middle East, North Africa, and the Mediterranean region. The actor has targeted both public- and private-sector organizations, with reported victim sectors including government, telecommunications, information technology, media, and non-governmental organizations. Its operations are consistent with strategic intelligence collection for political or economic purposes. The group became widely known for large-scale DNS hijacking activity observed between 2018 and 2020, and later evolved its tradecraft to include Linux and Unix post-compromise tooling such as SnappyTCP. SnappyTCP is a reverse shell backdoor used for command and control and persistence, with variants supporting both plaintext and TLS-protected communications. The malware has been compiled for multiple architectures and operating systems and has appeared in both executable and shared-object forms, indicating operational flexibility across heterogeneous environments. Sea Turtle has used exploitation of major internet-facing vulnerabilities for initial access, including CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847. After compromise, it has employed shell-based tooling, reverse shells, web-shell-style persistence, and HTTP-based command-and-control mechanisms. The actor has also used spoofed infrastructure and impersonation of legitimate organizations to support operations and reduce detection. Its activity demonstrates adaptation over time in tooling, infrastructure, and delivery methods, consistent with a mature state-aligned espionage capability.