Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.1234
- Talos Sea Turtle 2019
- Talos Sea Turtle 2019_2
- PWC Sea Turtle 2023
- Hunt Sea Turtle 2024
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Sea Turtle | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Teal Kurma | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Marbled Dust | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Cosmic Wolf | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | SILICON | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1690 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.011 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1557 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1027.004 | Compile After Delivery | — |
| T1059.004 | Unix Shell | — |
| T1071.001 | Web Protocols | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.003 | Local Accounts | — |
| T1114.001 | Local Email Collection | — |
| T1133 | External Remote Services | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1213.006 | Databases | — |
| T1505.003 | Web Shell | — |
| T1557 | Adversary-in-the-Middle | — |
| T1560.001 | Archive via Utility | — |
| T1564.011 | Ignore Process Interrupts | — |
| T1566 | Phishing | — |
| T1583 | Acquire Infrastructure | — |
| T1583.001 | Domains | — |
| T1583.002 | DNS Server | — |
| T1583.003 | Virtual Private Server | — |
| T1584.002 | DNS Server | — |
| T1588.002 | Tool | — |
| T1588.004 | Digital Certificates | — |
| T1608.003 | Install Digital Certificate | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1690 | Prevent Command History Logging | — |
Aliases
Cosmic Wolf · Marbled Dust · Sea Turtle · SILICON · Teal Kurma
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.