Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.1234
- Talos Sea Turtle 2019
- Talos Sea Turtle 2019_2
- PWC Sea Turtle 2023
- Hunt Sea Turtle 2024
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Sea Turtle | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Teal Kurma | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Marbled Dust | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Cosmic Wolf | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | SILICON | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1690 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.011 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1557 | 2024 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1027.004 | Compile After Delivery | — |
| T1059.004 | Unix Shell | — |
| T1071.001 | Web Protocols | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.003 | Local Accounts | — |
| T1114.001 | Local Email Collection | — |
| T1133 | External Remote Services | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1203 | Exploitation for Client Execution | — |
| T1213.006 | Databases | — |
| T1505.003 | Web Shell | — |
| T1557 | Adversary-in-the-Middle | — |
| T1560.001 | Archive via Utility | — |
| T1564.011 | Ignore Process Interrupts | — |
| T1566 | Phishing | — |
| T1583 | Acquire Infrastructure | — |
| T1583.001 | Domains | — |
| T1583.002 | DNS Server | — |
| T1583.003 | Virtual Private Server | — |
| T1584.002 | DNS Server | — |
| T1588.002 | Tool | — |
| T1588.004 | Digital Certificates | — |
| T1608.003 | Install Digital Certificate | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1690 | Prevent Command History Logging | — |
别名
Cosmic Wolf · Marbled Dust · Sea Turtle · SILICON · Teal Kurma
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。