A state-supported cyberespionage group likely affiliated to Turkey has been observed targeting numerous public and private entities in the Netherlands for intelligence gathering, Dutch incident response provider Hunt & Hackett reports.
Over the past year, the advanced persistent threat actor, tracked as Sea Turtle, Cosmic Wolf, Marbled Dust, Silicon, and Teal Kurma, targeted government, telecommunications, media, and NGO entities, along with ISPs and IT services providers in the country, as part of multiple espionage campaigns.
Sea Turtle, Hunt & Hackett says, mainly focused on telecoms, media, ISP, and IT services organizations, and targeted Kurdish websites, including some that are PKK affiliated.
The APT likely used the stolen information for surveillance or intelligence gathering, in line with previously detailed tactics observed in Sea Turtle attacks against organizations in Europe, Middle East, and North Africa.
Sea Turtle was initially detailed in 2019, when it stood out for its use of complex DNS hijacking techniques.
At that time security researchers did not align it with the interests of a government, albeit they did assess the group as being state-sponsored.
The group faded following public disclosure, but made it into the spotlight again a month ago, when PwC published an analysis of 'SnappyTCP', a reverse shell for Linux/Unix systems that the group had been using since 2021.
Since at least 2017, the APT has been exploiting known vulnerabilities for initial access, and is believed to have continued doing so over the past three years as well.
Following the initial intrusion, the group would run a shell script to drop an executable to the disk.
A simple reverse TCP shell for Linux, the webshell has basic command-and-control capabilities and likely allows the attackers to establish persistence.
The shell's code is identical to code found in a publicly accessible GitHub repository, which also hosts other samples used to establish reverse shells.
In late December, StrikeReady published its own analysis of Sea Turtle, providing indicators of compromise associated with the threat actor's activities.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 08 Jan 2024 15:13:04 +0000