Cisco Talos Reports Ongoing Sea Turtle DNS Hijacking Campaign

• •Sea Turtle campaign targets DNS systems of national security organizations.
• •At least 40 organizations across 13 countries have been compromised since 2017.
• •New DNS hijacking techniques have emerged, increasing the threat level.

Cisco Talos has identified a persistent cyber threat campaign named 'Sea Turtle' that manipulates DNS systems, primarily targeting national security organizations in the Middle East and North Africa. The campaign, which began as early as January 2017, has compromised at least 40 organizations across 13 countries. Recent findings indicate that the actors behind Sea Turtle have regrouped and are employing a new DNS hijacking technique, compromising name server records to respond to DNS requests with falsified A records. This new technique has only been observed in a few targeted operations, including a country code top-level domain (ccTLD) registry. The ongoing threat underscores the potential for broader attacks on the global DNS system, which could undermine internet trust and stability. Cisco Talos emphasizes the need for responsible nations to establish norms protecting the DNS system from such attacks.