Hunt Sea Turtle 2024

Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.

Sea Turtle used shell scripts for post-exploitation execution in victim environments.

Sea Turtle connected over TCP using HTTP to establish command and control channels.

Sea Turtle staged collected email archives in the public web directory of a website that was accessible from the internet.

Sea Turtle compromised cPanel accounts in victim environments.

Sea Turtle collected email archives from victim environments.

Sea Turtle has used external-facing SSH to achieve initial access to the IT environments of victim organizations.

Sea Turtle used the tool Adminer to remotely logon to the MySQL service of victim machines.

Sea Turtle deployed the SnappyTCP web shell during intrusion operations.

Sea Turtle used the tar utility to create a local archive of email data on a victim system.

Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.

Sea Turtle accessed victim networks from VPN service provider networks.

Sea Turtle registered domains for authoritative name servers used in DNS hijacking activity and for command and control servers.

Sea Turtle has used tools such as Adminer during intrusions.

Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.

Sea Turtle unset the Bash and MySQL history files on victim systems.