Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Sea Turtle · Unknown · assessed origin Türkiye · misp-galaxy + mitre-attack · refreshed 2026-10-06

Sea Turtle

  • COSMIC WOLF
  • Marbled Dust
  • SILICON
  • Teal Kurma
  • UNC1326
  • Cosmic Wolf

MITRE G1041 ↗

Sea Turtle — ATT&CK roseST

attack rose · 27 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2009-1151, CVE-2021-21974, CVE-2021-44228, CVE-2022-0847

Analyst brief

misp-galaxy + mitre-attack

This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet.

Manipulating that system has the potential to undermine the trust users have on the internet. That trust and the stability of the DNS system as a whole drives the global economy. Responsible nations should avoid targeting this system, work together to establish an accepted global norm that this system and the organizations that control it are off-limits, and cooperate in pursuing those actors who act irresponsibly by targeting this system.

Observed targets (as stated by the sources)

1 countries · 0 sectors
GermanyAssessed origin: Türkiye

assessed origin · Türkiyeobserved targets · 1

countries · 1

  • Germany

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

27 techniques · 9 of 15 tactics

  1. Resource development

    8 techniques

  2. Initial access

    3 techniques

  3. Execution

    2 techniques

  4. Persistence

    2 techniques

  5. Stealth

    4 techniques

  6. Defense impairment

    2 techniques

  7. Credential access

    1 technique

  8. Collection

    4 techniques

  9. Command and control

    1 technique

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
SnappyTCPS1163 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Sea Turtle is cited as exploiting

none on KEV
  1. CVE-2009-11512026-10-17
    1. “CVE-2009-1151 [11]: PHP code injection vulnerability affecting phpMyAdmin”

      cited as exploiting · named nearby · source: virusbulletin.com ↗ · 2026-10-17

    2. “CVE-2009-1151 : PHP code injection vulnerability affecting phpMyAdmin”

      cited as exploiting · named nearby · source: blog.talosintelligence.com ↗ · 2026-10-17

    3. “CVE-2009-1151 : PHP code injection vulnerability affecting phpMyAdmin”

      cited as exploiting · named nearby · source: blog.talosintelligence.com ↗ · 2026-10-17

  2. CVE-2021-219742026-10-17
    1. “Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2022-08472026-10-17
    1. “Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2021-442282026-10-17
    1. “Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2019Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniquesCisco ↗

Take it with you

keyless · no signup

References

20 sources
  1. 1.blog.talosintelligence.com/2019/04/seaturtle.html
  2. 2.blog.talosintelligence.com/sea-turtle-keeps-on-swimming
  3. 3.reuters.com/article/us-cyber-attack-hijack-exclusive/exclusive-hac…
  4. 4.icann.zoom.us/recording/play/AhQB4AQyjCuEJGz2wQQans0Xqkz3su8swGLQoOR…
  5. 5.community.icann.org/download/attachments/109483867/Cybersecurity%20and%20t…
  6. 6.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf
  7. 7.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-re…
  8. 8.domaintools.com/resources/blog/finding-additional-indicators-with-pass…
  9. 9.go.crowdstrike.com/rs/281-OBQ-266/images/Report2022GTR.pdf
  10. 10.query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi?id=101738
  11. +10 more in the JSON record

Track Sea Turtle on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.