Executive Summary
Sea Turtle deployed SnappyTCP between 2021–2023 to establish reverse‑socket command shells on Linux/Unix hosts, enabling adversaries to issue arbitrary commands and exfiltrate data from compromised systems. The tool is simple, open‑source derived, and designed for stealthy persistence, complicating detection. Defenders should monitor outbound connections to unusual ports or dynamic IPs and inspect web directories for foreign shell scripts.
Enhanced Description
SnappyTCP is a lightweight Linux and Unix web‑shell that has been used by the Sea Turtle APT group between 2021 and 2023 to compromise multiple infrastructure targets. The code base is derived from a now‑removed public GitHub repository, indicating that the adversaries re‑used an openly available script as a starting point before modifying it for operational stealth. The core functionality of SnappyTCP is a reverse TCP shell: once installed on an infected host it initiates an outbound connection to a remote command and control (C2) server, passing the victim’s local shell over that socket. Through this session adversaries can issue arbitrary commands, read/write files, and optionally upload payloads or exfiltrate data. The implementation is intentionally minimalistic, using standard POSIX utilities and avoiding complex back‑end services, which reduces its footprint and keeps it largely out of many signature‑based detections. Because the tool is distributed via web portals or as a simple download link, defenders typically encounter SnappyTCP during post‑compromise investigations rather than during initial intrusion. Its usage pattern—outbound tunnel to a controlled endpoint with CLI access—is consistent with Sea Turtle’s broader operational profile of maintaining persistent, low‑profile footholds in Linux‑centric environments. The limited public information means that analysts primarily rely on incident‑response reports (e.g., the PwC 2023 Sea Turtle paper) and forensic artifacts from infected systems. Consequently, many operational aspects—such as persistence mechanisms, payload delivery methods, or lateral movement techniques—remain undocumented at this time.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
The available data about SnappyTCP is derived primarily from a single PwC 2023 threat report referencing Sea Turtle activity. While the basic functionality as a reverse shell is confirmed, detailed capabilities such as persistence hooks, obfuscation techniques, or lateral movement behaviors remain undocumented, leaving gaps in the full threat profile.
SnappyTCP is a web shell used by Sea Turtle between 2021 and 2023 against multiple victims. SnappyTCP appears to be based on a public GitHub project that has since been removed from the code-sharing site. SnappyTCP includes a simple reverse TCP shell for Linux and Unix environments with basic command and control capabilities.(Citation: PWC Sea Turtle 2023)