Sea Turtle G1041

Também conhecido como: Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2022-0847 Alta · 7.8 KEV Linux Kernel Privilege Escalation Vulnerability

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

CVE-2021-44228 Crítica · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

CVE-2021-21974 ainda não publicada aqui

“Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

Técnicas por tática

Desenvolvimento de recursos

T1583 Acquire Infrastructure T1583.001 Domains T1583.002 DNS Server T1583.003 Virtual Private Server T1584.002 DNS Server T1588.002 Tool T1588.004 Digital Certificates T1608.003 Install Digital Certificate

Acesso inicial

T1078 Valid Accounts T1078.003 Local Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566 Phishing

Execução

T1059.004 Unix Shell T1203 Exploitation for Client Execution

Persistência

T1078 Valid Accounts T1078.003 Local Accounts T1133 External Remote Services T1505.003 Web Shell

Escalada de privilégios

T1078 Valid Accounts T1078.003 Local Accounts

Furtividade

T1027.004 Compile After Delivery T1078 Valid Accounts T1078.003 Local Accounts T1564.011 Ignore Process Interrupts

Comprometimento de defesas

T1685.006 Clear Linux or Mac System Logs T1690 Prevent Command History Logging

Acesso a credenciais

T1557 Adversary-in-the-Middle

Coleta

T1074.002 Remote Data Staging T1114.001 Local Email Collection T1213.006 Databases T1557 Adversary-in-the-Middle T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols

Malwares e ferramentas

SnappyTCPMalwareS1163