TurkeyAssessedTürkiye-linkedEspionageActive 2017 – 2025Sea Turtle
Also known asCosmic Wolf · Teal Kurma · Marbled Dust · UNC1326 · SILICON
Summary
Türkiye-linked espionage actor (MITRE G1041 Sea Turtle; CrowdStrike Cosmic Wolf), DNS-hijacking specialist. Türkiye-nexus APT known for large-scale DNS hijacking campaigns. Active since 2017, first exposed by Cisco Talos in 2019 under 'Sea Turtle'. BSI's list of APT groups active against Germany or comparable European targets in the last two years (as of April 2026) includes Cosmic Wolf / Sea Turtle / Marbled Dust in the IT-services sector. PwC and Hunt & Hackett documented 2021–2023 campaigns targeting Dutch ISPs, telecom providers, IT firms, and Kurdish websites. Technique centres on compromising domain registrars and DNS providers to redirect victim domains to attacker infrastructure for credential harvesting. Uses SnappyTCP (reverse TCP shell in C/C++) and AdderDrop. In 2024–2025 Microsoft (as Marbled Dust) observed it exploiting a zero-day in Output Messenger (CVE-2025-27920) against users associated with the Kurdish military in Iraq. Targeting aligns with Turkish state intelligence priorities — PKK/Kurdish political operations, diaspora surveillance, and regional diplomatic collection.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Türkiye-linked - Hunt & Hackett (Research, 2024-01-05)
State-supported espionage advancing Turkey's interests
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| IT-services targeting (BSI active-APT list)ASSESSED | 2024-04 – 2026-04 | Germany, Europe | Technology | BSI Aktive APT-Gruppen in Deutschland (Stand 2026-04-14) |
| Output Messenger zero-day espionage against Kurdish military in Iraq | 2024-04 – 2025-05 | Iraq | Military, Government | Microsoft Threat Intelligence (2025-05-12) |
| Dutch ISP & Telco Campaign | 2021 – 2023 | Netherlands | Telecommunications, Technology | Hunt & Hackett (2024-01-05) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Resource Development2 | T1584.002DNS ServerT1583.002DNS Server |
|---|---|
| Initial Access2 | T1566.001Spearphishing AttachmentT1190Exploit Public-Facing Application |
| Persistence1 | T1098Account Manipulation |
| Credential Access1 | T1557Adversary-in-the-Middle |
| Collection1 | T1074.002Remote Data Staging |
| Command and Control1 | T1071Application Layer Protocol |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| SnappyTCP | Reverse TCP Shell (C/C++) | Linux |
| AdderDrop | Implant | Linux |
| OMServerService | GoLang backdoor masquerading as Output Messenger server component | Windows |
| OMClientService | GoLang client-side backdoor | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4j "Log4Shell" — JNDI RCE (KEV 2021-12-10) |
| CVE-2021-21974 | 8.8 | VMware ESXi OpenSLP — heap overflow RCE (not in KEV) |
| CVE-2022-0847 | 7.8 | Linux kernel "Dirty Pipe" — privilege escalation (KEV 2022-04-25) |
| CVE-2025-27920 | 7.2 | Srimax Output Messenger — Server Manager directory traversal (KEV 2025-05-19) |
Highest CVSS first.
Infrastructure patterns
- Compromised DNS registries and registrars used to redirect government traffic (Microsoft, 2025)
- cPanel logins from VPN-provider and hosting-provider IPs (Hunt & Hackett, 2024)
Reporting and advisories 5
- BSI
Active APT Groups in Germany (April 2026) - Hunt & Hackett
Dutch ISP & Telco Campaign - BSI Aktive APT-Gruppen in Deutschland
IT-services targeting (BSI active-APT list) - Microsoft Threat Intelligence
Output Messenger zero-day espionage against Kurdish military in Iraq - MITRE ATT&CK
Sea Turtle (G1041) group profile