Sea Turtle (MITRE G1041; Microsoft 'Marbled Dust') is a Turkiye-aligned espionage group notorious for DNS hijacking and service-provider compromise, targeting government, telecom and IT organizations across the Middle East, Europe and beyond.
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
Sea Turtle was first exposed by Cisco Talos in 2019 for an aggressive DNS-hijacking campaign that compromised registrars and DNS providers to redirect victims and harvest credentials via spoofed login portals. MITRE tracks it as G1041, with aliases including Teal Kurma (PwC), Marbled Dust (Microsoft), Cosmic Wolf and SILICON; activity dates to at least 2017.
The group's hallmark is abusing trust in core internet infrastructure: DNS record manipulation at ccTLD and provider level, plus typo-squatted domains and credential interception, to reach downstream targets. More recent operations pair this with conventional intrusion tooling, including reverse-shell and Golang backdoors and web shells.
MENA relevance is central to Sea Turtle's mission. Its DNS-hijacking wave (2018-2020) intercepted government IT traffic in Greece, Cyprus and Iraq, and its targeting consistently aligns with Turkish strategic interests, especially Kurdish entities. In May 2025, Microsoft reported Marbled Dust exploiting an Output Messenger zero-day (CVE-2025-27920) to deploy Golang backdoors against Kurdish military-linked targets in Iraq, a campaign ongoing since at least April 2024. The group also resurfaced against Dutch IT and telecom firms (reported 2024).
Confidence in the activity is high given multi-vendor corroboration (Talos, PwC, Microsoft, Hunt.io); the Turkiye-state alignment is a high-confidence assessment based on consistent victimology and interest alignment, though not an official government attribution.
+21 more relationships — see the relationships browser.
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.