🇹🇷

Sea Turtle

APT Group Information theft and espionage 3 zero-day CVEs ETDA ✓

Also Known As 5 names

COSMIC WOLF Marbled Dust SILICON Teal Kurma UNC1326

Target Countries 20

Countries highlighted in red

United Arab Emirates Albania Armenia Switzerland Cyprus Germany Egypt United Kingdom Greece Iraq Jordan Lebanon Libya Netherlands Russian Federation Sudan Sweden Syrian Arab Republic Turkey United States

Sectors Targeted

Defense Aerospace Intelligence agencies Think Tanks Telecommunications Electronics and Appliance Stores 44314 Energy Human Resources Consulting Services 541612 NGOs Government

Details

Origin 🇹🇷 TR

Last Updated 21 May 2024

Malware Families 1

snappy_tcp

MITRE ATT&CK 52

T1021.001 T1027 T1027.004 T1040 T1059 T1059.004 T1070 T1070.002 T1071 T1071.001 T1074 T1074.002 T1078 T1078.003 T1090.004 T1095 T1114 T1114.001 T1133 T1190 T1195 T1199 T1203 T1213 T1213.006 T1505 T1505.003 T1547 T1557 T1560 T1560.001 T1562 T1562.003 T1564 T1564.011 T1566 T1583 T1583.001 T1583.002 T1583.003 T1584 T1584.002 T1588 T1588.002 T1588.004 T1596.001 T1608 T1608.003 T1685 T1685.006 T1690 TA0035

Related Zero-Days 3

CVE-2024-0012 CVE-2024-24919 CVE-2024-3400

Known Names 6 entries

Sea Turtle Talos

Silicon Microsoft

UNC1326 FireEye

Marbled Dust Microsoft

Teal Kurma PwC

Cosmic Wolf CrowdStrike

Observed Target Countries 17

Based on ETDA data — countries highlighted in red

Albania Armenia Cyprus Egypt Greece Iraq Jordan Lebanon Libya Netherlands Sudan Sweden Switzerland Syria Turkey UAE USA

Description

(Talos) Cisco Talos has discovered a new cyber threat campaign that we are calling “Sea Turtle,” which is targeting public and private entities, including national security organizations, located primarily in the Middle East and North Africa. The ongoing operation likely began as early as January 2017 and has continued through the first quarter of 2019. Our investigation revealed that at least 40 different organizations across 13 different countries were compromised during this campaign. We assess with high confidence that this activity is being carried out by an advanced, state-sponsored actor that seeks to obtain persistent access to sensitive networks and systems. The actors behind this campaign have focused on using DNS hijacking as a mechanism for achieving their ultimate objectives. DNS hijacking occurs when the actor can illicitly modify DNS name records to point users to actor-controlled servers. The Department of Homeland Security (DHS) issued an alert about this activity on Jan. 24 2019, warning that an attacker could redirect user traffic and obtain valid encryption certificates for an organization’s domain names.

Tools Used 2

Drupalgeddon DNS hijacking

Operations 3

2018-01 Talos now has moderate confidence that the threat actors behind Sea Turtle have been using another DNS hijacking technique. This new technique has been used very sparingly, and thus far have only identified two entities that were targeted in 2018, though we believe there are likely more.

2019-04 The Institute of Computer Science of the Foundation for Research and Technology – Hellas (ICS-Forth), the ccTLD for Greece, acknowledged on its public website that its network had been compromised on April 19, 2019. Based on Cisco telemetry, we determined that the actors behind the Sea Turtle campaign had access to the ICS-Forth network. https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html

2021 Turkish espionage campaigns in the Netherlands https://www.huntandhackett.com/blog/turkish-espionage-campaigns

Reports & References 3

https://blog.talosintelligence.com/2019/04/seaturtle.html https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html https://blog.strikeready.com/blog/pivoting-through-a-sea-of-indicators-to-spot-turtles/

ETDA Profile

Sea Turtle

Origin

Turkey

First Seen 2017

Motivation

Information theft and espionage

View on ETDA APT Groups ↗