Sea Turtle

Sea Turtle is a Turkey-linked state-supported espionage threat actor known for DNS hijacking, adversary-in-the-middle credential collection, and Linux-focused post-compromise activity. Widely used aliases include SILICON, Teal Kurma, Marbled Dust, and Cosmic Wolf; Microsoft has associated the actor with the Türkiye-attributed Dust naming family. The group has been active since at least 2017 and is assessed to pursue intelligence collection aligned with Turkish strategic interests. Sea Turtle became particularly notable for large-scale DNS hijacking operations against public and private organizations. Its operations have included modifying registrar or name server settings, redirecting victim traffic to actor-controlled infrastructure, impersonating legitimate services with fraudulent or impersonating certificates, and harvesting credentials through man-in-the-middle workflows. The actor has also operated dedicated adversary-in-the-middle servers and targeted internet infrastructure providers and registries to enable downstream compromises of additional victims. Targeting has centered on government organizations, telecommunications providers, internet service providers, IT service providers, energy companies, think tanks, NGOs, media organizations, airports, and Kurdish political or affiliated entities. Reported victim geography spans Europe, the Middle East, and North Africa, with specific activity documented against organizations in Greece, the Netherlands, and Syria. The actor has also shown interest in domestic Turkish political issues and information on minority groups and dissidents. Beyond DNS hijacking, Sea Turtle has conducted direct intrusions into Linux-hosted environments using compromised cPanel accounts and SSH access, followed by shell-based post-exploitation. Observed tradecraft includes use of reverse shells, HTTP-based command and control, deployment of Adminer, collection of email archives for likely exfiltration, and anti-forensic measures such as clearing shell history and overwriting logs. Sea Turtle has also been observed downloading source code to victim systems and compiling it locally with GCC, reflecting an effort to evade static detection and blend into legitimate administrative activity. Additional reported behaviors include persistence through boot or logon initialization mechanisms and use of privileged container execution in Linux environments. Overall, Sea Turtle is best characterized as a Turkish espionage actor specializing in credential theft and surveillance-enabling access operations, combining infrastructure compromise, DNS manipulation, adversary-in-the-middle collection, and hands-on-keyboard intrusion techniques to support strategic intelligence gathering.