G1041 · ATT&CK 19.1 group

Sea Turtle

[Sea Turtle](https://attack.mitre.org/groups/G1041) is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. [Sea Turtle](https://attack.mitre.org/groups/G1041) is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling [Sea Turtle](https://attack.mitre.org/groups/G1041) to spoof log in portals and other applications for credential collection.(Citation: Talos Sea Turtle 2019)(Citation: Talos Sea Turtle 2019_2)(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)

Aliases: Cosmic Wolf, Marbled Dust, SILICON, Sea Turtle, Teal Kurma

Mapped techniques (27)

T1027.004T1059.004T1071.001T1074.002T1078T1078.003T1114.001T1133T1190T1199T1203T1213.006T1505.003T1557T1560.001T1564.011T1566T1583T1583.001T1583.002T1583.003T1584.002T1588.002T1588.004T1608.003T1685.006T1690

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 12 — Human-layer and physical testing
Red Team & Offensive Security · explicit-nameMalware, phishing, ransomware, and behavior extraction
Digital Forensics & Incident Response (DFIR) · explicit-nameHuman, workload, pipeline, and emergency identity
Cloud Security · explicit-nameScenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-name