Indicators of Compromise

82.102.19.88

The IP-address is of M247 Europe SRL located in Belgium and was used as VPN by Sea Turtle to logon to a cPanel account.

62.115.255.163

The IP-address is of Arelion and located in Denmark and was used as VPN by Sea Turtle to logon on to a cPanel account.

forward.boord.info

The malware SnappyTCP was used by Sea Turtle to establish a command-and-control channel with the domain name.