Edward Kiledjian

As Turkey’s digital infrastructure expands, so too does its exposure to cyber threats. Recent insights from top cybersecurity firms have highlighted Advanced Persistent Threat (APT) groups with suspected links to Turkey. In this article, we explore the key players, their methods, and the broader implications for global cybersecurity.

Sea Turtle: A Growing Concern

One of the most significant Turkey-linked APT groups is Sea Turtle, also known as Teal Kurma or Marbled Dust. Active since at least 2017, Sea Turtle has primarily targeted organizations in Europe and the Middle East.

Main Targets:

• Government agencies
• Kurdish political groups
• Telecommunications companies
• Internet Service Providers (ISPs)
• IT service providers
• Non-Governmental Organizations (NGOs)
• Media and entertainment sectors

Tactics and Techniques:

• DNS hijacking (2017-2019)
• Supply chain and island-hopping attacks
• Use of a reverse TCP shell named SnappyTCP for Linux/Unix systems
• Compromising cPanel accounts
• SSH for initial access

Sea Turtle’s operations seem to align with Turkey’s strategic goals, focusing on intelligence gathering related to specific groups and individuals.

StrongPity: A Persistent Threat

Another prominent Turkey-linked APT group is StrongPity, also known as Promethium. Active since at least 2012, StrongPity has largely focused on Turkey and its neighbouring regions.

Main Targets:

• Users in Turkey, Syria, and nearby countries
• Government entities
• Telecommunications sector
• Military and defence organizations
• Individuals interested in encryption tools

Tactics and Techniques:

• Watering hole attacks as a key infection method
• Trojanized versions of legitimate software installers
• Spear-phishing campaigns
• Exploitation of vulnerable web servers
• Deployment of custom backdoors and spyware
• Compromised routers for botnet creation
• Mobile malware campaigns targeting Android users

StrongPity’s operations suggest a focus on surveillance and intelligence gathering, potentially serving Turkey’s geopolitical interests.

Evolving Tactics

Turkish APT groups have increasingly adopted more sophisticated attack methods:

1. Improved Evasion: Groups like Sea Turtle have enhanced their ability to avoid detection, using defence evasion techniques to stay under the radar.
2. Strategic Web Compromises: Employed to passively exploit targets, including intercepting web traffic to victim websites.
3. Phishing Campaigns: Tapping into geopolitical events and themes relevant to Turkey, such as natural disasters or political tensions.
4. Service Provider Exploitation: Gaining access to networks through managed service providers and IT companies.
5. Mobile Malware: Expanding operations to target Android users with trojanized apps, as observed with StrongPity.
6. DNS Hijacking: Sea Turtle was particularly known for this technique between 2017-2019, though they have since broadened their methods.

The Geopolitical Angle

The activities of these APT groups often reflect broader geopolitical tensions:

• Targeting Kurdish websites and political groups aligns with Turkey’s domestic and regional policies.
• Focusing on European political entities, especially during periods of regional strain.
• Surveillance operations in Turkey and Syria suggest priorities in domestic and regional intelligence gathering.
• The groups’ activities often align with Turkey’s strategic interests in the Middle East and Europe.
• Increased cyber activities have coincided with times of diplomatic tension between Turkey and other nations.

Implications for Cybersecurity

The emergence of Turkey-linked APT groups underscores the evolving nature of cyber threats:

1. Expanding Threat Landscape: As more countries develop cyber capabilities, organizations must adapt their defences.
2. Supply Chain Vulnerabilities: Targeting of service providers highlights the need for robust supply chain security measures.
3. Geopolitical Awareness: Understanding regional tensions can help predict and prepare for potential cyber threats.
4. Mobile Security: The expansion into mobile platforms highlights the need for comprehensive mobile device security.

Protective Measures

To counter these and other APT threats, organizations should:

• Implement strong DNS security measures to prevent hijacking
• Regularly update and patch systems to close known vulnerabilities
• Use multi-factor authentication across all critical systems
• Provide ongoing security awareness training, especially about phishing and social engineering
• Monitor for suspicious activities, especially those linked to known APT tactics
• Be cautious when downloading software, especially from untrusted sources
• Implement robust mobile device management and security policies
• Deploy comprehensive endpoint protection solutions that leverage AI and machine learning
• Use network segmentation to limit lateral movement within compromised networks
• Employ continuous network monitoring and threat hunting to detect stealthy intrusions

As Turkey’s cyber capabilities continue to evolve, staying informed about these threat actors and their methods is crucial. By remaining vigilant and adopting comprehensive security measures, organizations can better protect themselves against the growing threat of state-sponsored cyberattacks, including those from emerging actors like Turkey-linked APT groups.