Sea Turtle

Sea Turtle is a Türkiye-linked threat actor active since at least 2017, known for conducting espionage and service provider compromise operations targeting victims in Asia, Europe, and North America. The group is notable for targeting registrars managing ccTLDs and executing complex DNS-based intrusions, compromising DNS providers to hijack DNS resolution. This enabled Sea Turtle to spoof login portals and other applications for credential collection.