Background
Sea Turtle is a state-sponsored threat group attributed to Turkey that has been active since at least 2017. The group is distinctive for its primary attack methodology — DNS hijacking — which involves compromising DNS infrastructure to redirect traffic from legitimate domains, enabling interception of credentials and sensitive communications at scale.
Sea Turtle''s operations are assessed to support Turkish national intelligence objectives, targeting government organizations, diplomatic missions, telecommunications providers, and energy companies in countries of strategic interest to Turkey, including Greece, Cyprus, Iraq, Syria, Lebanon, Armenia, and Kurdish diaspora communities in Europe.
The group''s DNS hijacking technique is particularly dangerous because it compromises infrastructure that many organizations consider trusted, enabling man-in-the-middle attacks that are invisible to end users. Cisco Talos initially documented these operations in 2019, and subsequent research by Hunt & Hackett and others has confirmed the group''s continued activity.
Notable Campaigns
DNS Hijacking Campaign (2017-2019) — Cisco Talos documented Sea Turtle''s systematic compromise of DNS registrars, DNS hosting providers, and telecommunications companies to modify DNS records for government and diplomatic targets. The hijacked DNS records redirected email and VPN traffic through attacker-controlled servers, enabling credential harvesting and communications interception for targets in the Middle East and North Africa.
European Targeting Expansion (2020-2022) — Hunt & Hackett documented Sea Turtle expanding operations to target Kurdish political organizations, media outlets, and diaspora communities in the Netherlands and other European countries. The campaigns used a combination of DNS manipulation and direct server compromise.
SnappyTCP Campaign (2023-2024) — PwC documented Sea Turtle deploying a new custom reverse shell tool called SnappyTCP against telecommunications companies and ISPs. The campaign targeted Linux-based server infrastructure, reflecting the group''s evolution from pure DNS hijacking to more conventional server compromise operations.
Tactics, Techniques & Procedures
Sea Turtle''s signature technique is DNS hijacking — compromising DNS registrars, hosting providers, or the DNS infrastructure of target organizations to modify DNS records. By redirecting A records for email (MX) and VPN endpoints, the group can intercept authentication traffic and harvest credentials without touching the target''s own network.
The group compromises DNS infrastructure through credential theft (often from previous DNS hijacking of the registrar''s own domains), exploitation of registrar web interfaces, and social engineering of domain administration contacts.
Beyond DNS hijacking, Sea Turtle conducts direct server compromise using exploitation of internet-facing applications and deploys custom reverse shells for persistent access. The group has demonstrated capability on both Windows and Linux platforms.
Tools & Malware
DNS Hijacking Infrastructure — Custom tooling for modifying DNS records at compromised registrars and hosting providers. Includes man-in-the-middle proxy servers that intercept and relay traffic while capturing credentials from redirected authentication flows.
SnappyTCP — Custom reverse shell targeting Linux systems. Provides encrypted communication channels and persistent access to compromised servers. Deployed against telecommunications and ISP infrastructure.
Credential Harvesting Proxies — Custom HTTPS proxy servers deployed to intercept traffic from hijacked domains. Capture usernames and passwords from email, VPN, and web application login flows while proxying the legitimate traffic to avoid detection.
Custom Reverse Shells — Various lightweight reverse shells for Linux and Windows platforms, used for persistent access after initial compromise of DNS or server infrastructure.
Indicators & Detection
DNS monitoring is the most critical defense against Sea Turtle. Implement DNSSEC to prevent unauthorized DNS record modification. Monitor DNS records for your organization''s domains, particularly MX and A records for email and VPN services, using external DNS monitoring services that alert on unexpected changes.
Certificate monitoring is essential — Sea Turtle obtains legitimate TLS certificates for hijacked domains from certificate authorities (typically Let''s Encrypt). Monitor Certificate Transparency logs for unexpected certificate issuance for your organization''s domains.
Network defenders should implement certificate pinning for critical services (email, VPN) where possible, and train users to verify TLS certificate details when connecting to sensitive services. Monitor for authentication from unusual geographic locations following DNS record changes.
Telecommunications and ISP organizations should implement enhanced monitoring for SnappyTCP indicators: unusual reverse shell connections from Linux servers, unexpected outbound connections from DNS infrastructure, and unauthorized access to domain management interfaces.