By 
The Turkish state-backed hacker group Sea Turtle was found targeting telcos, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the Netherlands as part of a new cyber espionage campaign.
Sea Turtle, also known as Teal Kurma and Cosmic Wolf, earlier focused on the Middle Eastern region, as well as Sweden and the United States, using techniques like DNS hijacking and traffic redirection to perform man-in-the-middle attacks against government and non-government organizations, media, ISPs, and IT service providers.
The recent campaign on the Netherlands was observed by analysts at Hunt & Hackett, who report that Sea Turtle remains a threat group of moderate sophistication, primarily using known flaws and compromised accounts for initial access while failing to hide their activity trace effectively.
The Sea Turtle activity was observed in the Netherlands between 2021 and 2023, with new techniques and malware being introduced recently.
The attacks target specific organizations and appear to be focused on acquiring economic and political intelligence that aligns with the Turkish state's interests.
Initial access in the observed attacks is achieved by using compromised cPanel accounts to SSH onto the target infrastructure.
A new tool deployed in the recent Sea Turtle attacks is 'SnappyTCP,' an open-source reverse TCP shell for Linux that offers basic command and control (C2) capabilities.
The tool remains active on the system to serve as a persistent backdoor by using the 'NoHup' command, preventing its termination even when the threat actors have logged out.
The researchers also report seeing the installation of the Adminer database management tool in the public directory of one of the compromised cPanel accounts, giving them persistent data access and SQL command execution capabilities.
The attackers created copies of email archives from compromised cPanel accounts and placed them in the public web directory of a website, making them available for downloading.
Despite Sea Turtle's techniques being classified as moderately sophisticated, the group continues to pose a significant threat to organizations globally.
To mitigate this threat, it is recommended to deploy strict network monitoring, enable MFA on all critical accounts, and reduce SSH exposure to the minimum required systems.
