Sea Turtle
Also reported as Marbled Dust, Teal Kurma, SILICON, UNC1326, COSMIC WOLF and 2 other names. Linked to Turkey by four sources.
Reports per quarter
Techniques in ATT&CK
Listed by ATT&CK
Show all 27 techniques Show fewer
No report from the last two years names a technique ID.
CVEs named in reports
- CVE-2009-1151 KEV
- CVE-2014-6271 KEV
- CVE-2014-6277
- CVE-2014-7169 KEV
- CVE-2014-7186
- CVE-2014-7187
- CVE-2017-11774 KEV
- CVE-2017-12617 KEV
- CVE-2017-3881 KEV
- CVE-2017-6736 KEV
- CVE-2018-0296 KEV
- CVE-2018-20250 KEV ransomware
Show all 22 CVEs Show fewer
- CVE-2018-2025036
- CVE-2018-7600 KEV ransomware
- CVE-2018-8453 KEV ransomware
- CVE-2021-21974
- CVE-2021-44228 KEV ransomware
- CVE-2022-0847 KEV
- CVE-2022-30190 KEV ransomware
- CVE-2023-38831 KEV ransomware
- CVE-2024-30051 KEV ransomware
- CVE-2025-10035 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor StoneDrill (Malware Family)
-
Sea Turtle - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Sea Turtle - Threat Group Cards: A Threat Actor Encyclopedia
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Crimson RAT (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor METALJACK (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor elf.wellmess (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SUNBURST (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor QakBot (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor REvil (Malware Family)
Show all 32 reports Show fewer
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PowGoop (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ryuk (Malware Family)
-
Threat-Hunting Tactics - Tracking the Sea Turtle Group
The original link failed its last check. Original publisher Detailsfor Threat-Hunting Tactics - Tracking the Sea Turtle Group
-
DNS Hijacking Abuses Trust In Core Internet Service
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor DNS Hijacking Abuses Trust In Core Internet Service
-
Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
-
Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Sea Turtle Keeps on Swimming
-
DNS Hijacking Abuses Trust In Core Internet Service
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor DNS Hijacking Abuses Trust In Core Internet Service
-
DNS Hijacking Abuses Trust In Core Internet Service
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor DNS Hijacking Abuses Trust In Core Internet Service
Newest first. Details opens the report in Explore.