Sea Turtle

Names and who uses them

• Sea TurtleOur name
• SILICONMicrosoft
• Cosmic WolfPwC
• Marbled DustPwC
• Teal KurmaPwC

Targets

Regions: Europe, North America

Known techniques

• T1027.004Compile After Delivery
• T1059.004Unix Shell
• T1071.001Web Protocols
• T1074.002Remote Data Staging
• T1078Valid Accounts
• T1078.003Local Accounts
• T1114.001Local Email Collection
• T1133External Remote Services
• T1190Exploit Public-Facing Application
• T1199Trusted Relationship
• T1203Exploitation for Client Execution
• T1213.006Databases
• T1505.003Web Shell
• T1557Adversary-in-the-Middle
• T1560.001Archive via Utility
• T1564.011Ignore Process Interrupts
• T1566Phishing
• T1583Acquire Infrastructure
• T1583.001Domains
• T1583.002DNS Server
• T1583.003Virtual Private Server
• T1584.002DNS Server
• T1588.002Tool
• T1588.004Digital Certificates
• T1608.003Install Digital Certificate
• T1685.006Clear Linux or Mac System Logs
• T1690Prevent Command History Logging

Malware and tools used