Watch Floor
State-backedTurkeyMITRE G1041

Sea Turtle

Also known as COSMIC WOLF, Marbled Dust, SILICON, Teal Kurma, UNC1326

0mentions, 7 days
0mentions, 30 days
nonelast mentioned

This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet. Manipulating that system has the potential to undermine the trust users have on the internet. That trust and the stability of the DNS system as a whole drives the global economy. Responsible nations should avoid targeting this system, work together to establish an accepted global norm that this system and the organizations that control it are off-limits, and cooperate in pursuing those actors who act irresponsibly by targeting this system.

Targets: Germany

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1027.004 Compile After DeliveryT1059.004 Unix ShellT1071.001 Web ProtocolsT1074.002 Remote Data StagingT1078 Valid AccountsT1078.003 Local AccountsT1114.001 Local Email CollectionT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1203 Exploitation for Client ExecutionT1213.006 DatabasesT1505.003 Web ShellT1557 Adversary-in-the-MiddleT1560.001 Archive via UtilityT1564.011 Ignore Process InterruptsT1566 PhishingT1583 Acquire InfrastructureT1583.001 DomainsT1583.002 DNS ServerT1583.003 Virtual Private ServerT1584.002 DNS ServerT1588.002 ToolT1588.004 Digital CertificatesT1608.003 Install Digital CertificateT1685.006 Clear Linux or Mac System LogsT1690 Prevent Command History Logging

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.