Sea Turtle

    TürkiyeUnknown

    Observation period

    27

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet. Manipulating that system has the potential to undermine the trust users have on the internet. That trust and the stability of the DNS system as a whole drives the global economy. Responsible nations should avoid targeting this system, work together to establish an accepted global norm that this system and the organizations that control it are off-limits, and cooperate in pursuing those actors who act irresponsibly by targeting this system.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target countries according to source Germany

    Aliases

    • COSMIC WOLF
    • Marbled Dust
    • SILICON
    • Teal Kurma
    • UNC1326

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview