A new cyber espionage campaign has emerged that is targeting telecommunications, media, internet service providers (ISPs), IT service providers, and Kurdish websites in the Netherlands. This current campaign against Dutch IT and telecom companies is reportedly being led by a Turkish threat group known as Sea Turtle, also commonly known as Cosmic Wolf, Marbled Dust, or UNC1326, which has previously performed state-sponsored attacks in the past targeting public and private entities in the Middle East and North Africa. The group was first documented in April 2019, but there has been ongoing activity associated with it since at least January 2017, where the group is most notoriously observed utilizing DNS hijacking for credential harvesting purposes. Researchers have also seen Sea Turtle collecting intelligence aligned with strategic Turkish interests from countries including Armenia, Cyprus, Greece, Iraq, and Syria. As part of this ongoing campaign, the threat actors have been seen collecting the personal information of minority groups and potential political dissents by targeting infrastructures susceptible to supply chain and island-hopping attacks. The adversary has also been found using a simple reverse TCP shell for Linux/Unix systems called SnappyTCP that has basic command-and-control (C2) capabilities and is speculated to be used for establishing persistence. CTIX will continue to monitor and report on threat actor activity.