What tactics and techniques does Sea Turtle use?

How Sea Turtle Blends Network Abuse with Account Compromise

sea turtle’s core playbook combines name-system interference with direct account compromise, which makes it useful to think about as both traffic redirection and trust abuse. DNS hijacking lets the actor steer victims away from legitimate infrastructure, while credential theft and web compromise give it the access needed to operate inside trusted paths and alter what users or systems see.

The practical effect is that the campaign is not limited to one layer. A registrar account, DNS zone, web application, or administrative portal may each be only one step in the chain, but compromise at any of them can create the same outcome: malicious infrastructure presented as legitimate. That is why defenders need to review the integrity of the whole trust path, not just the endpoint.

For a broader view of how attackers are organized and tracked across campaigns, Threat Actor Groups Guide is useful context for understanding how this kind of activity is described, attributed, and compared across reporting.

What the Tactics and Techniques Indicate About the Attack Chain

“DNS hijacking” points to manipulation of resolution or delegation so victims are sent to attacker-controlled destinations. “Credential theft” points to collection of usernames, passwords, tokens, or similar access material that can be reused to change DNS records, access hosting, or enter web administration interfaces. “Web compromise” means the actor can tamper with content, scripts, redirects, or server-side behavior to support interception or deception.

Together, these techniques show an emphasis on trust inversion. Rather than breaking encryption directly, the actor tries to sit between the user and the legitimate service, then rely on normal browser, certificate, and resolver behavior to make the malicious path look ordinary. That is why certificate anomalies, unexpected redirects, and changes in external dependencies are meaningful signals in this case.

Sea Turtle’s focus on internet-facing services also matters. Exposure is often highest where administrative access is reachable from the internet, where DNS is managed through third parties, or where web content is deployed through multiple accounts and vendors. A weak link in any of those places can become an entry point or a way to persist.

For readers mapping the technique set to adversary tradecraft, the MITRE ATT&CK Enterprise Matrix is the most directly useful external reference for thinking about credential access, web compromise, and follow-on abuse of trusted infrastructure.

Why This Campaign Matters for Detection and Response

Sea Turtle’s methods are effective because they can blend into routine administration. DNS changes may be legitimate in some environments, web content changes may happen frequently, and account activity by service owners may not stand out unless baselined. That makes this a detection problem as much as a prevention problem.

Defenders should be especially alert to registrar logins from unfamiliar geographies, unauthorized changes to NS, A, AAAA, MX, or CNAME records, certificate mismatches, unexpected redirects, and changes in web assets that do not line up with a planned release. In parallel, any compromise of a registrar or web admin account should trigger a search for prior malicious change windows, because the first observable symptom is often downstream of initial access.

Top 10 Phishing Techniques is relevant here because credential theft is frequently enabled by the same social and session-abuse patterns that are used to capture trusted access in other campaigns.

Practitioner Guidance

What to prioritise: Treat registrar, DNS, certificate, and web-admin access as a single trust surface. If one of those accounts is compromised, assume the attacker may be able to redirect traffic before they are visible in endpoint tooling.

What to verify: Confirm who can change DNS, who can approve registrar actions, where hosted web content is updated, and whether certificate and redirect monitoring is alerting on unexpected drift. Evidence should show both the change and the actor behind it.

Decision rule: If a suspicious DNS or web change appears, rotate the affected credentials and review historical changes first, then determine whether the attacker used the same access path to stage additional infrastructure abuse.

Practitioner takeaway: Sea Turtle is a reminder that trust-path abuse is often more dangerous than a single compromised host, because one stolen account or altered DNS record can redirect many users at once.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?