Various companies in the telecommunications, media, Internet service providers (ISP) and information technology (IT) sectors in the Netherlands are being targeted by a new cyber espionageby hackers known as Sea Turtle.
“ The targets’ infrastructure was susceptible to supply chain and island-hopping attacks, which the hacking group used to gather information politically motivated , such as personal information about minority groups and potential political dissent ,” Dutch security firm Hunt & Hackett said on Friday .
“Stolen information is likely to be used for monitoring or gathering information about specific groups or individuals.“.
See also: Kyivstar hack Ukraine: Russian hackers caused serious damage
The Sea Turtle hackers are also known by the names Cosmic Wolf, Marbled Dust (formerly Silicon), Teal Kurma, and UNC1326 and were first identified by Cisco Talos in April 2019. The company had then described the attacks targeting public and private entities in the Middle East and North Africa.
The group's attacks are believed to have begun in January 2017, primarily utilizing DNS hijacking to redirect potential targets attempting to query a specific domain to a server controlled by the actors and capable of collecting their credentials.
In late 2021, Microsoft noted that the group was collecting information that served Turkey’s strategic interests and was targeting countries including Armenia, Cyprus, Greece, Iraq, and Syria, hitting telecommunications and IT companies. The goal was to “establish a foothold in the desired target by exploiting known vulnerabilities.”
Last month, it was revealed that the Sea Turtle hackers were using a simple reverse TCP shell for Linux (and UNIX) called SNAPPYTCP. This was done from 2021 to 2023, according to the PricewaterhouseCoopers (PWC) Intelligence Group.
See also: Iranian hackers APT33 target defense companies with FalseFont backdoor
“The web shell is a simple reverse TCP shell for Linux/Unix that has basic [Command-and-Control] capabilities and is also likely to be used to establish persistence,” the company said. “There are at least two main variants: one that uses OpenSSL to establish a secure connection over TLS and another that sends requests in clearText.”
The latest findings from Hunt & Hackett show that the Sea Turtle group continues to be a significant threat in the field of espionage.
Protection from cyber espionage
One of the most effective ways to protect digital data is to use strong passwords. Passwords should be unique, difficult to guess, and changed regularly. Additionally, using different passwords for different services can help prevent access to all of your data if someone manages to gain access to one password.
Using up-to-date security software is another important way to protect digital data from hackers like Sea Turtle. This software includes antivirus, anti-malware software, firewalls, and other tools that can detect and prevent cyberespionage attempts.
See also: The FBI hit ALPHV/ BlackCat ransomware but hackers aren't giving up!
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Education and awareness about cyber espionage tactics are also critical. Users need to be aware of the various methods used by attackers, such as phishing, social engineering , and malware, and how to recognize and avoid them.
Finally, the use of encryption can provide an additional layer of protection. Encryption converts data into a form that can only be decrypted with a special key, making it unintelligible to attackers.
Source: thehackernews.com
