Sea Turtle (G1041) | Threat Actor Index

About Sea Turtle

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.

View MITRE record ↗

Techniques by Tactic (27)

Resource Development

T1583 Acquire InfrastructureT1583.001 DomainsT1583.002 DNS ServerT1583.003 Virtual Private ServerT1584.002 DNS ServerT1588.002 ToolT1588.004 Digital CertificatesT1608.003 Install Digital Certificate

Initial Access

T1078 Valid AccountsT1078.003 Local AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566 Phishing

Execution

T1059.004 Unix ShellT1203 Exploitation for Client Execution

Persistence

T1078 Valid AccountsT1078.003 Local AccountsT1133 External Remote ServicesT1505.003 Web Shell

Privilege Escalation

T1078 Valid AccountsT1078.003 Local Accounts