Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques
Summary: Cisco Talos reports that the actors behind the Sea Turtle DNS hijacking campaign regrouped after the initial findings were published and continued operating with new infrastructure, including a new technique in which the actor-controlled name server and hijacked hostnames resolved to the same IP address for typically less than 24 hours. Talos identified a new wave of victims including the Greek ccTLD registry ICS-Forth, which acknowledged a network compromise on April 19, 2019, and whose access was used against three .gr government entities via the newly registered name server rootdnservers[.]com.
Why it matters: A country-code registry that manages DNS records for every domain under its country code was compromised, and the actors kept access to that network for at least five days after the compromise was publicly acknowledged - meaning the trust anchor for an entire national namespace sat in adversary hands.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026