SeaDuke

SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar. [1]

ID: S0053
Associated Software: SeaDaddy, SeaDesk
Type: MALWARE
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1059 Command-Line Interface

SeaDuke is capable of executing commands.[4]

Enterprise T1002 Data Compressed

SeaDuke compressed data with zlib prior to sending it over C2.[2]

Enterprise T1132 Data Encoding

SeaDuke C2 traffic is base64-encoded.[4]

Enterprise T1114 Email Collection

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[3]

Enterprise T1107 File Deletion

SeaDuke can securely delete files, including deleting itself from the victim.[3]

Enterprise T1097 Pass the Ticket

Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.[3]

Enterprise T1086 PowerShell

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[3]

Enterprise T1060 Registry Run Keys / Startup Folder

SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.[4]

Enterprise T1105 Remote File Copy

SeaDuke is capable of uploading and downloading files.[4]

Enterprise T1064 Scripting

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[3]

Enterprise T1023 Shortcut Modification

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.[4]

Enterprise T1045 Software Packing

SeaDuke has been packed with the UPX packer.[4]

Enterprise T1071 Standard Application Layer Protocol

SeaDuke uses HTTP and HTTPS for C2.[1]

Enterprise T1032 Standard Cryptographic Protocol

SeaDuke C2 traffic has been encrypted with RC4 and AES.[2][4]

Enterprise T1078 Valid Accounts

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[3]

Enterprise T1084 Windows Management Instrumentation Event Subscription

SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.[5]

Groups That Use This Software

ID Name References
G0016 APT29 [1]

References