Sea Turtle

Sea Turtle is a Türkiye-based, state-supported cyberespionage threat actor aligned with Turkish strategic interests. Also known as SILICON, Teal Kurma, Marbled Dust, Cosmic Wolf, and UNC1326, it has targeted government entities, telecommunications and media organizations, internet service providers, IT and security service providers, energy organizations, think tanks, NGOs, airports, and Kurdish-affiliated entities across Europe, the Middle East, and North Africa. Its operations focus on intelligence collection, including politically sensitive information concerning minority groups and perceived political dissidents. Sea Turtle became prominent for DNS-hijacking campaigns conducted from 2017 through 2019. These operations altered victim name-server records, used actor-controlled name servers and impersonated TLS certificates, and supported adversary-in-the-middle interception of webmail and other internet traffic to harvest credentials. The group was linked to compromise of infrastructure associated with Greece’s country-code top-level-domain registry, which was used to facilitate further targeting of Greek government entities. More recent activity has included compromise of web-hosting environments through SSH access to cPanel accounts using valid credentials of unknown provenance. Sea Turtle has used Linux and Unix reverse shells, including SnappyTCP, to execute commands and maintain remote access; downloaded and locally compiled source code using GCC; collected email archives; and exfiltrated data through TCP and HTTP channels. The actor has also used anti-forensic measures, including clearing shell and database histories and overwriting Linux logs. Sea Turtle has demonstrated supply-chain and island-hopping targeting opportunities against exposed service-provider infrastructure.