G1041 · ATT&CK 20.0 group
Sea Turtle
Aliases: Cosmic Wolf, Marbled Dust, SILICON, Sea Turtle, Teal Kurma
[Sea Turtle](https://attack.mitre.org/groups/G1041) is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. [Sea Turtle](https://attack.mitre.org/groups/G1041) is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling [Sea Turtle](https://attack.mitre.org/groups/G1041) to spoof log in portals and other applications for credential collection.(Citation: Talos Sea Turtle 2019)(Citation: Talos Sea Turtle 2019_2)(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)
Aliases: Cosmic Wolf, Marbled Dust, SILICON, Sea Turtle, Teal Kurma
ATT&CK techniques
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1027.004 Compile After Delivery simulation — Exact active technique ID
- T1027.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.002 Remote Data Staging simulation — Exact active technique ID
- T1074.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.001 Local Email Collection simulation — Exact active technique ID
- T1114.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.006 Databases simulation — Exact active technique ID
- T1213.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1557 Adversary-in-the-Middle simulation — Exact active technique ID
- T1557 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.011 Ignore Process Interrupts simulation — Exact active technique ID
- T1564.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566 Phishing simulation — Exact active technique ID
- T1566 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583 Acquire Infrastructure simulation — Exact active technique ID
- T1583 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.002 DNS Server simulation — Exact active technique ID
- T1583.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.002 DNS Server simulation — Exact active technique ID
- T1584.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.004 Digital Certificates simulation — Exact active technique ID
- T1588.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.003 Install Digital Certificate simulation — Exact active technique ID
- T1608.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.006 Clear Linux or Mac System Logs simulation — Exact active technique ID
- T1685.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1690 Prevent Command History Logging simulation — Exact active technique ID
- T1690 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 12 — Human-layer and physical testing
Red Team & Offensive Security · explicit-nameMalware, phishing, ransomware, and behavior extraction
Digital Forensics & Incident Response (DFIR) · explicit-nameHuman, workload, pipeline, and emergency identity
Cloud Security · explicit-nameScenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-name
Vulnerability Research & Exploit Development · explicit-idModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 12 — Human-layer and physical testing
Red Team & Offensive Security · explicit-nameMalware, phishing, ransomware, and behavior extraction
Digital Forensics & Incident Response (DFIR) · explicit-nameHuman, workload, pipeline, and emergency identity
Cloud Security · explicit-nameScenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · explicit-nameModule 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-name