Trusted Design

Sea Turtle

アクターID: G1041

· MITRE Pageへのリンク

脅威アクターの詳細

Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.(Citation: Talos Sea Turtle 2019)(Citation: Talos Sea Turtle 2019_2)(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)

脅威アクターの別名・別称

Sea Turtle
Teal Kurma
Marbled Dust
Cosmic Wolf
SILICON

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1037 - Boot or Logon Initialization Scripts
• T1033 - System Owner/User Discovery
• T1123 - Audio Capture
• T1596.001 - DNS/Passive DNS
• T1499.003 - Application Exhaustion Flood
• T1587.003 - Digital Certificates
• T1063 - Security Software Discovery
• T1497.001 - System Checks
• T1587.002 - Code Signing Certificates
• T1140 - Deobfuscate/Decode Files or Information
• T1098.007 - Additional Local or Domain Groups
• T1218 - System Binary Proxy Execution
• T1555.003 - Credentials from Web Browsers
• T1175 - Component Object Model and Distributed COM
• T1528 - Steal Application Access Token
• T1122 - Component Object Model Hijacking
• T1199 - Trusted Relationship
• T1562.013 - Disable or Modify Network Device Firewall
• T1686.002 - Network Device Firewall
• T1157 - Dylib Hijacking
• T1218.010 - Regsvr32
• T1685 - Disable or Modify Tools
• T1137.004 - Outlook Home Page
• T1059.013 - Container CLI/API
• T1556.005 - Reversible Encryption
• T1490 - Inhibit System Recovery

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1059.013)
• CVE-2015-5749 (T1059.013)
• CVE-2016-1898 (T1059.013)
• CVE-2016-1897 (T1059.013)
• CVE-2015-7261 (T1140)
• CVE-2015-6036 (T1497.001)
• CVE-2015-7262 (T1157)
• CVE-2015-0932 (T1059.013)
• CVE-2010-3081 (T1157)
• CVE-2017-16929 (T1059.013)
• CVE-2025-31125 (T1157)
• CVE-2025-68645 (T1059.013)
• CVE-2015-5119 (T1059.013)
• CVE-2015-2546 (T1157)
• CVE-2015-7645 (T1059.013)
• CVE-2017-12149 (T1059.013)
• CVE-2015-3090 (T1059.013)
• CVE-2015-3113 (T1059.013)
• CVE-2014-6271 (T1059.013)
• CVE-2016-1010 (T1059.013)
• CVE-2016-1019 (T1059.013)
• CVE-2016-0984 (T1059.013)
• CVE-2016-1001 (T1059.013)
• CVE-2016-0998 (T1059.013)
• CVE-2015-5130 (T1059.013)
• CVE-2015-5134 (T1059.013)
• CVE-2015-5539 (T1059.013)
• CVE-2015-5557 (T1059.013)
• CVE-2015-5563 (T1059.013)
• CVE-2015-5559 (T1059.013)
• CVE-2015-5540 (T1059.013)
• CVE-2015-5561 (T1059.013)
• CVE-2015-5551 (T1059.013)
• CVE-2015-5564 (T1059.013)
• CVE-2015-5565 (T1059.013)
• CVE-2015-5550 (T1059.013)
• CVE-2015-5566 (T1059.013)
• CVE-2015-5127 (T1059.013)
• CVE-2015-5556 (T1059.013)
• CVE-2015-2852 (T1218.010)
• CVE-2015-7755 (T1218.010)
• CVE-2016-1287 (T1059.013)
• CVE-2016-9494 (T1140)
• CVE-2025-55182 (T1140)
• CVE-2012-1258 (T1157)
• CVE-2014-7911 (T1059.013)
• CVE-2013-6282 (T1059.013)
• CVE-2013-0074 (T1059.013)
• CVE-2014-8439 (T1059.013)
• CVE-2014-0569 (T1059.013)
• CVE-2015-0310 (T1218.010)
• CVE-2014-0556 (T1059.013)
• CVE-2015-5560 (T1059.013)
• CVE-2014-9163 (T1059.013)
• CVE-2014-8440 (T1059.013)
• CVE-2010-0738 (T1157)
• CVE-2010-0232 (T1218.010)
• CVE-2014-3393 (T1497.001)
• CVE-2014-3897 (T1059.013)
• CVE-2011-0611 (T1059.013)
• CVE-2017-0001 (T1059.013)
• CVE-2023-1389 (T1157)
• CVE-2025-24893 (T1059.013)
• CVE-2025-34026 (T1218.010)
• CVE-2025-55183 (T1157)
• CVE-2025-55184 (T1140)
• CVE-2025-66478 (T1098.007)
• CVE-2010-1553 (T1059.013)
• CVE-2014-4322 (T1157)
• CVE-2010-0806 (T1059.013)
• CVE-2009-3129 (T1059.013)
• CVE-2025-13928 (T1685)
• CVE-2014-4114 (T1059.013)
• CVE-2015-5122 (T1059.013)
• CVE-2015-1427 (T1059.013)
• CVE-2015-1770 (T1059.013)
• CVE-2012-1856 (T1059.013)
• CVE-2015-2545 (T1059.013)
• CVE-2014-6332 (T1059.013)
• CVE-2015-3785 (T1499.003)
• CVE-2015-5897 (T1157)
• CVE-2017-0199 (T1059.013)
• CVE-2015-3043 (T1059.013)
• CVE-2015-3456 (T1059.013)
• CVE-2015-2590 (T1685)
• CVE-2015-2424 (T1059.013)
• CVE-2015-0097 (T1059.013)
• CVE-2012-0158 (T1059.013)
• CVE-2014-1761 (T1059.013)
• CVE-2015-2502 (T1059.013)
• CVE-2013-2094 (T1157)
• CVE-2014-4113 (T1157)
• CVE-2015-8562 (T1059.013)
• CVE-2015-7808 (T1059.013)
• CVE-2012-1889 (T1059.013)
• CVE-2015-1641 (T1059.013)
• CVE-2015-1701 (T1157)
• CVE-2015-0313 (T1059.013)
• CVE-2015-0359 (T1059.013)
• CVE-2014-0329 (T1175)
• CVE-2015-3628 (T1059.013)
• CVE-2015-2854 (T1218.010)
• CVE-2012-4969 (T1059.013)
• CVE-2015-6585 (T1059.013)
• CVE-2015-6022 (T1059.013)
• CVE-2016-2342 (T1059.013)
• CVE-2017-0263 (T1157)
• CVE-2016-9496 (T1157)
• CVE-2016-9495 (T1218.010)
• CVE-2017-3212 (T1059.013)
• CVE-2015-0311 (T1059.013)
• CVE-2013-3906 (T1059.013)
• CVE-2014-6352 (T1059.013)
• CVE-2015-0016 (T1218.010)
• CVE-2012-0056 (T1157)
• CVE-2010-3333 (T1059.013)
• CVE-2012-3213 (T1685)
• CVE-2012-4792 (T1059.013)
• CVE-2014-0322 (T1059.013)
• CVE-2015-0336 (T1059.013)
• CVE-2011-3544 (T1685)
• CVE-2014-3153 (T1218.010)
• CVE-2015-3636 (T1157)
• CVE-2015-3105 (T1059.013)
• CVE-2014-0497 (T1059.013)
• CVE-2014-8361 (T1556.005)
• CVE-2012-0507 (T1685)
• CVE-2013-2465 (T1685)
• CVE-2013-2551 (T1059.013)
• CVE-2010-0188 (T1059.013)
• CVE-2014-0515 (T1059.013)
• CVE-2012-4681 (T1059.013)
• CVE-2014-1776 (T1059.013)
• CVE-2012-1876 (T1059.013)
• CVE-2015-0057 (T1157)
• CVE-2012-2539 (T1059.013)
• CVE-2012-1723 (T1685)
• CVE-2015-1761 (T1157)
• CVE-2013-3660 (T1157)
• CVE-2010-1297 (T1059.013)
• CVE-2010-2884 (T1059.013)
• CVE-2015-2360 (T1157)
• CVE-2014-4148 (T1059.013)
• CVE-2011-3402 (T1059.013)
• CVE-2010-2883 (T1059.013)
• CVE-2013-0634 (T1059.013)
• CVE-2014-7247 (T1059.013)
• CVE-2012-5054 (T1059.013)
• CVE-2013-2678 (T1059.013)
• CVE-2015-2426 (T1059.013)
• CVE-2008-1436 (T1490)
• CVE-2010-4398 (T1157)
• CVE-2013-0641 (T1059.013)
• CVE-2013-0640 (T1059.013)
• CVE-2012-6422 (T1059.013)
• CVE-2013-2595 (T1137.004)
• CVE-2015-4902 (T1140)
• CVE-2010-2572 (T1059.013)
• CVE-2011-1255 (T1059.013)
• CVE-2013-5990 (T1059.013)
• CVE-2012-0611 (T1059.013)
• CVE-2015-2419 (T1059.013)
• CVE-2016-0189 (T1059.013)
• CVE-2016-4117 (T1059.013)
• CVE-2017-0143 (T1059.013)
• CVE-2025-54313 (T1063)
• CVE-2017-0261 (T1140)
• CVE-2017-0262 (T1140)
• CVE-2016-6532 (T1497.001)
• CVE-2015-0071 (T1218.010)
• CVE-2013-7331 (T1157)
• CVE-2014-6324 (T1157)
• CVE-2015-2387 (T1157)
• CVE-2017-8570 (T1497.001)
• CVE-2015-5477 (T1497.001)
• CVE-2016-1991 (T1059.013)
• CVE-2015-2853 (T1218.010)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1218.010)
• CVE-2016-1562 (T1059.013)
• CVE-2016-2343 (T1497.001)
• CVE-2017-17215 (T1059.013)
• CVE-2026-20127 (T1157)
• CVE-2026-0723 (T1685)
• CVE-2016-1990 (T1059.013)
• CVE-2015-6034 (T1157)
• CVE-2025-13927 (T1685)
• CVE-2026-1102 (T1685)
• CVE-2025-13335 (T1685)
• CVE-2014-2273 (T1059.013)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る