The Dutch IT and telecommunications sectors have recently become the focus of a sophisticated cyber espionage campaign. This initiative, spearheaded by a threat group associated with Turkish interests and known as Sea Turtle, has specifically targeted sectors including telecommunications, media, internet service providers (ISPs), information technology (IT) services, and Kurdish websites in the Netherlands.
Sea Turtle’s operations are characterized by two primary attack strategies: supply chain attacks and island-hopping attacks.
Stay One Step Ahead of Cyber Threats
Supply chain attacks target the less secure elements in a network’s supply chain while island-hopping attacks involve compromising one target to move laterally to others. The primary objective of these attacks is the collection of sensitive political data, particularly personal information on minority groups and political dissidents. The overarching goal of these activities is to conduct surveillance and intelligence gathering.
Initially documented by Cisco Talos in April 2019, the Sea Turtle group has been active since January 2017. A significant technique in their arsenal is DNS hijacking, which involves redirecting domain name system (DNS) queries to malicious servers to steal credentials. This method has been a hallmark of their operations, showcasing their sophisticated approach to cyber espionage.
Recent Developments and Tactics
In 2021, Microsoft highlighted the group’s activities, noting their alignment with Turkey’s strategic interests. One notable tool used by Sea Turtle is SnappyTCP, a reverse TCP shell that facilitates remote control and command execution. This tool became especially prominent in attacks carried out between 2021 and 2023.
A striking example of their recent tactics occurred in 2023 when Sea Turtle used compromised cPanel accounts, a common web hosting control panel, to deploy SnappyTCP. This enabled them to create and exfiltrate copies of email archives, further emphasizing their focus on information extraction for intelligence purposes.
"Amateurs hack systems, professionals hack people."
-- Bruce Schneier, a renown computer security professional
