What other aliases and vendor names is Sea Turtle known by?

Sea Turtle is tracked across the cybersecurity industry by multiple aliases, including: COSMIC WOLF, G1041, Marbled Dust, SILICON, Teal Kurma, UNC1326.

What vulnerabilities and CVEs does Sea Turtle actively exploit?

Sea Turtle has been observed weaponizing vulnerabilities including CVE-2025-27920, CVE-2026-20212.

Sea Turtle

Q: What are the primary motivations and sponsors of Sea Turtle?

Sea Turtle operates from Turkey with primary motivation categorized as Political and economic espionage, specifically targeting entities of interest to the Turkish state and monitoring Kurdish political and military organizations., sponsored or affiliated with Government of Turkey.

ACTIVE CAMPAIGN TRACKED ▲ High Threat Turkey

Primary Aliases: UNC1326 COSMIC WOLF G1041 Marbled Dust

Sponsor / State Affiliation Government of Turkey

Primary Motivation Political and economic espionage, specifically targeting entities of interest to the Turkish state and monitoring Kurdish political and military organizations.

Confidence Rating 95% (Grounded)

Output Messenger Zero-Day Operation, Netherlands Espionage Campaign

⚔️ Weaponized CVE Matrix (2)

CVE-2025-27920

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

CVE-2026-20212

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Government Telecommunications Internet Service Providers (ISPs) IT Service Providers NGOs Media & Entertainment Kurdish Military and Political Groups (e.g., PKK) National Security Organizations