Sea Turtle G1041

Also known as: Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

associated CVEs

Techniques

Malware and tools

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2022-0847 High · 7.8 KEV Linux Kernel Privilege Escalation Vulnerability

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

CVE-2021-44228 Critical · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

CVE-2021-21974 not published here yet

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

Techniques by tactic

Resource Development

T1583 Acquire Infrastructure T1583.001 Domains T1583.002 DNS Server T1583.003 Virtual Private Server T1584.002 DNS Server T1588.002 Tool T1588.004 Digital Certificates T1608.003 Install Digital Certificate

Initial Access

T1078 Valid Accounts T1078.003 Local Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566 Phishing

Execution

T1059.004 Unix Shell T1203 Exploitation for Client Execution

Persistence

T1078 Valid Accounts T1078.003 Local Accounts T1133 External Remote Services T1505.003 Web Shell

Privilege Escalation

T1078 Valid Accounts T1078.003 Local Accounts

Stealth

T1027.004 Compile After Delivery T1078 Valid Accounts T1078.003 Local Accounts T1564.011 Ignore Process Interrupts

Defense Impairment

T1685.006 Clear Linux or Mac System Logs T1690 Prevent Command History Logging

Credential Access

T1557 Adversary-in-the-Middle

Collection

T1074.002 Remote Data Staging T1114.001 Local Email Collection T1213.006 Databases T1557 Adversary-in-the-Middle T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols

Malware and tools

SnappyTCPMalwareS1163