Sea Turtle
IntrusionSet · ATTACK:enterprise:G1041
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1041",
"title": "Sea Turtle",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1041",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--56a05d27-4d47-418a-b330-781c5614f202",
"external_id": "G1041",
"domain": "enterprise",
"created": "2024-11-20T18:21:28.242Z",
"modified": "2026-07-31T18:47:56.961Z",
"version": "1.0",
"aliases": [
"Sea Turtle",
"Teal Kurma",
"Marbled Dust",
"Cosmic Wolf",
"SILICON"
],
"tactics": [
],
"source_references": [
{
"source_name": "SILICON"
},
{
"source_name": "Teal Kurma"
},
{
"source_name": "Marbled Dust"
},
{
"source_name": "Cosmic Wolf"
},
{
"source_name": "Talos Sea Turtle 2019",
"url": "https://blog.talosintelligence.com/seaturtle/"
},
{
"source_name": "Hunt Sea Turtle 2024",
"url": "https://www.huntandhackett.com/blog/turkish-espionage-campaigns"
},
{
"source_name": "Microsoft Digital Defense 2021",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi?id=101738"
},
{
"source_name": "Talos Sea Turtle 2019_2",
"url": "https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"
},
{
"source_name": "PWC Sea Turtle 2023",
"url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"
}
]
}Explicit source assertions (28)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a68df25-bb5c-4c03-a65f-491b9a52cfc5
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1074.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22a9798e-0aa3-4230-aab5-f0cb346e6e21
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44321d5a-7717-4c7b-8e3d-8f6db5239179
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--446a0478-5f02-4f0d-ac42-8cb5654008e0
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1608.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44eada28-5194-4661-9ef1-b0a0bfa29af6
Talos Sea Turtle 2019ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49d7f44b-7b35-4b86-8930-2e6bb644776a
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1584.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dfb2beb-4473-446e-beee-42729d8f87da
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50192f98-81e1-4175-9070-5576c6b93b65
Talos Sea Turtle 2019ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5063d844-fd04-478e-8812-399ba4e7fa58
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5853e513-667f-4384-a803-e443889f8095
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1564.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--599bed00-d9d8-49a2-9001-d985b0b08fba
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--612d9ccc-07ab-44fd-b970-869e9a730b02
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6496a79b-5946-4928-a92f-d8372e9c5de8
Talos Sea Turtle 2019 · PWC Sea Turtle 2023ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a5adaba-f234-4bae-b71e-40eda5f5bd26
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--941a9634-bacb-4389-bb17-09212c937683
PWC Sea Turtle 2023ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:S1163
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a20f841-8072-4240-8939-863863d5476f
PWC Sea Turtle 2023ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9860318-23fa-4a76-bbe4-b3f7ccd7b9c5
Talos Sea Turtle 2019ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad5cf8f1-5915-41e2-87d5-a06ac1e6b3b6
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b197d556-bb6b-499b-9c0b-98e2d946edf9
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2a746d2-7f9c-4e84-adee-d5ffaa6fd141
Hunt Sea Turtle 2024 · Talos Sea Turtle 2019_2ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1027.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9dd5132-06ab-4982-b76b-89a9d7b78a47
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1685.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1c161ef-1dca-488d-b50d-8a5c98980e35
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2c3385c-2d4c-4ef5-9064-8b33d976353c
Hunt Sea Turtle 2024 · PWC Sea Turtle 2023ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e3eae7-879c-456c-a216-be6be395a582
Hunt Sea Turtle 2024 · PWC Sea Turtle 2023ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e99047df-3542-438f-ba61-d0035daae707
Talos Sea Turtle 2019ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb65138d-8c50-42e3-b0e9-acb49454e22b
Hunt Sea Turtle 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1199
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef3683c7-1514-4fa3-9c2d-477fb945982a
Talos Sea Turtle 2019ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5f42525-f682-400c-ac85-477a7063c4d9
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2