Procedure examples

Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.

Sea Turtle used shell scripts for post-exploitation execution in victim environments.

Sea Turtle connected over TCP using HTTP to establish command and control channels.

Sea Turtle staged collected email archives in the public web directory of a website that was accessible from the internet.

Sea Turtle used compromised credentials to maintain long-term access to victim environments.

Sea Turtle compromised cPanel accounts in victim environments.

Sea Turtle collected email archives from victim environments.

Sea Turtle has used external-facing SSH to achieve initial access to the IT environments of victim organizations.

Sea Turtle gained access to victim environments by exploiting multiple known vulnerabilities over several campaigns.

Sea Turtle targeted third-party entities in trusted relationships with primary targets to ultimately achieve access at primary targets. Entities targeted included DNS registrars, telecommunication companies, and internet service providers.

Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.

Sea Turtle used the tool Adminer to remotely logon to the MySQL service of victim machines.

Sea Turtle deployed the SnappyTCP web shell during intrusion operations.

Sea Turtle modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.

Sea Turtle used the tar utility to create a local archive of email data on a victim system.

Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.

Sea Turtle used spear phishing to gain initial access to victims.

Sea Turtle accessed victim networks from VPN service provider networks.

Sea Turtle registered domains for authoritative name servers used in DNS hijacking activity and for command and control servers.

Sea Turtle built adversary-in-the-middle DNS servers to impersonate legitimate services that were later used to capture credentials.

Sea Turtle created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture.

Sea Turtle modified Name Server (NS) items to refer to Sea Turtle-controlled DNS servers to provide responses for all DNS lookups.

Sea Turtle has used tools such as Adminer during intrusions.

Sea Turtle created new certificates using a technique called the actors performed "certificate impersonation," a technique in which Sea Turtle obtained a certificate authority-signed X.509 certificate from another provider for the same domain imitating the one already used by the targeted organization.

Sea Turtle captured legitimate SSL certificates from victim organizations and installed these on Sea Turtle-controlled infrastructure to enable subsequent adversary-in-the-middle operations.

Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.

Sea Turtle unset the Bash and MySQL history files on victim systems.