Sea Turtle, a group of hackers aligned with the Turkish government, has returned after going undetected since 2020.
Dutch cybersecurity provider, Hunt & Hackett, reported on January 5, 2024, that Sea Turtle has been conducting multiple espionage campaigns in the Netherlands.
The APT group has also targeted Kurdish websites, especially those affiliated with the Kurdistan Workers' Party.
Previously known to carry out DNS hijacking, Sea Turtle has deployed new approaches in recent campaigns.
During one of the 2023 operations the group reportedly used a compromised account on cPanel, a web hosting control panel used by multiple organizations worldwide, from an IP address used by a VPN provider.
The cPanel account was used to perform an SSH login from an IP address belonging to a hosting provider.
This allowed Sea Turtle to get into the IT infrastructure of its target.
Next, Sea Turtle used the Unix shell Bash to execute malicious commands.
The hacking group used a reverse TCP shell for Linux/Unix operating systems named SnappyTCP, whose source code is available on GitHub, according to a December 2023 PwC report.
SnappyTCP can be used to steal data, install additional malware or launch other attacks.
Adminer is a publicly available database management tool that can be used to log on to the MySQL service of a system remotely.
Finally, the threat actor sent commands to the system using SnappyTCP to create a copy of an e-mail archive in the public web directory of the website that was accessible from the internet.
Sea Turtle is an advanced persistent threat group allegedly tied to, or aligned with, the Turkish government.
In the initial report, Cisco Talos detailed espionage attacks targeting public and private entities in the Middle East and North Africa.
The group's motivations are primarily focused on acquiring economic and political intelligence through espionage, and information theft that targets public and private entities.
The group became prominent between 2018 and 2020 when it conducted a series of DNS hijacking campaigns that intercepted traffic of government IT systems in Greece, Cyprus and Iraq.
Microsoft's Digital Defense Report 2021 noted that the threat actor carries out intelligence collection campaigns in countries like Armenia, Cyprus, Greece, Iraq and Syria.
A report published by PwC in early December 2023 introduced the group's use of SnappyTCP. Meanwhile, cloud-based security operations provider Strike Ready published a report relating to Sea Turtle on its own blog in late December 2023.
The firm focused on a specific Sea Turtle activity: spoofing Kurdish news sites, NGO sites and TV channels in the Arab world.
In the Hunt & Hackett report the firm shared a list of recommendations to help Sea Turtle's main targets reduce both the attack surface and the likelihood of becoming a victim.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Mon, 08 Jan 2024 14:05:19 +0000