Sea Turtle

Overview

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.

Naming & attribution

Sea Turtle is tracked under 5 names across the industry. It uses 27 documented ATT&CK techniques — more than 61% of the 174 groups tracked here. Activity attributed since at least 2017.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1608.003 Install Digital Certificate — used by 1 of 174 groups
• T1584.002 DNS Server — used by 2 of 174 groups
• T1557 Adversary-in-the-Middle — used by 3 of 174 groups
• T1564.011 Ignore Process Interrupts — used by 3 of 174 groups
• T1583.002 DNS Server — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Axiom China — 6 shared techniques (16% overlap)
• Threat Group-3390 China — 10 shared techniques (14% overlap)
• VOID MANTICORE Iran — 10 shared techniques (13% overlap)
• Play — 6 shared techniques (13% overlap)
• GOLD SOUTHFIELD — 4 shared techniques (13% overlap)
• Sandworm Team Russia — 11 shared techniques (12% overlap)

Regions

Germany

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190, T1203

TTPs — 27 techniques across 9 tactics

Tools & malware (1)

SnappyTCP

Reporting (3)

• Turkish espionage campaigns in the Netherlands — Hunt & Hackett Research Team
• The Tortoise and The Malware — PwC Threat Intelligence
• Microsoft Digital Defense Report — Microsoft