Summary
- Threat Actor: Sea Turtle (Türkiye-nexus), a.k.a. Teal Kurma, Cosmic Wolf, Marbled Dust
- Motivation: State-affiliated espionage
- Targeting: AWS and/or Azure environments, Government, Internet Service Providers, Technology, Telecommunications, etc.
- Attack Types: DNS-hijacking, zero-day exploitation, credentials and cloud storage theft, etc.
- Defenses: Identity security, storage protection, network traffic monitoring, vulnerability management, etc.
If you enjoy reading about cloud threat actors, you might also enjoy our training or investigating your own cloud incidents with Cloud Labs.
Overview
Sea Turtle is a Türkiye-nexus threat actor known for conducting state-affiliated espionage operations since at least 2017. The group has primarily targeted government agencies, IT service providers, and the telecommunications sector, with a notable evolution in tactics over the past decade.
Sea Turtle initially gained attention for its DNS hijacking campaigns, which redirected traffic to steal credentials, often targeting Middle Eastern and European entities. This activity persisted from 2017 through 2020. By 2021, the group had shifted toward exploiting exposed credentials and known vulnerabilities to gain access to internet service providers and related infrastructure, often as a path to reach downstream victims. This mentioned activity continued into 2023, when Sea Turtle was observed deploying a custom Linux/Unix implant and expanding into cloud-focused intrusions.
In one case, the group targeted a technology company’s cloud environment using stolen credentials to attempt data theft. Using the cloud environments command line they altered security group settings to allow direct Secure Shell (SSH) access. Since April 2024, Sea Turtle has been observed exploiting unpatched user accounts vulnerable to a zero-day (CVE-2025-27920) in Output Messenger, a cross-platform enterprise messaging application.
Cloud TTPs
All of the details below are also available in our GitHub repository, which provides background on each observed technique along with corresponding MITRE ATT&CK mappings, making it easy to map these insights directly to your cloud logs.
Inferences and Limitations
In CrowdStrike’s 2023 Cloud Risk Report, they briefly describe how Cosmic Wolf (a.k.a. Sea Turtle), targeted data in a victim’s cloud environment. The report is provider-agnostic, yet the combination of ‘security group’ changes and CLI usage suggests either AWS or Azure.
Additionally, we assess it is likely the actor used T1530 (Data from Cloud Storage Object) and T1537 (Exfiltration to Cloud Account), inferred from the objective of targeting stored cloud data; this is consistent with common cloud-intrusion tradecraft. However, the report does not provide details on:
- How credentials were stolen;
- What specific data was accessed (e.g., S3 vs. RDS); or
- Whether any exfiltration was confirmed.
Furthermore, there is no mention of the use of other services (e.g., Lambda, IAM role creation, or temporary credentials), which limits visibility into potential persistence or privilege escalation techniques (e.g., T1078.004, T1098).
Incident Response Steps
Below are several high-impact steps to prepare for and respond to the TTPs mentioned above. The list isn’t exhaustive, but it highlights key areas where defenders can focus their efforts. Click each step to view additional details.