Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!

SeaDuke

SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar. [1]

ID: S0053
Aliases: SeaDuke, SeaDaddy, SeaDesk
Type: MALWARE
Platforms: Windows

Version: 1.0

Techniques Used

DomainIDNameUse
EnterpriseT1059Command-Line InterfaceSeaDuke is capable of executing commands.[2]
EnterpriseT1002Data CompressedSeaDuke compressed data with zlib prior to sending it over C2.[3]
EnterpriseT1132Data EncodingSeaDuke C2 traffic is base64-encoded.[2]
EnterpriseT1114Email CollectionSome SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[4]
EnterpriseT1107File DeletionSeaDuke can securely delete files, including deleting itself from the victim.[4]
EnterpriseT1097Pass the TicketSome SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.[4]
EnterpriseT1086PowerShellSeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[4]
EnterpriseT1060Registry Run Keys / Startup FolderSeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.[2]
EnterpriseT1105Remote File CopySeaDuke is capable of uploading and downloading files.[2]
EnterpriseT1064ScriptingSeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[4]
EnterpriseT1023Shortcut ModificationSeaDuke is capable of persisting via a .lnk file stored in the Startup directory.[2]
EnterpriseT1045Software PackingSeaDuke has been packed with the UPX packer.[2]
EnterpriseT1071Standard Application Layer ProtocolSeaDuke uses HTTP and HTTPS for C2.[1]
EnterpriseT1032Standard Cryptographic ProtocolSeaDuke C2 traffic has been encrypted with RC4 and AES.[3][2]
EnterpriseT1078Valid AccountsSome SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[4]
EnterpriseT1084Windows Management Instrumentation Event SubscriptionSeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.[5]

Groups

Groups that use this software:

APT29

References