TTP Tuesday: APT29 - 2016 Democratic National Committee

Stage and Execute SeaDuke Malware

Mar 1, 2022

Theme Overview

01 March 2022

Our last release looked at the 2015 Pentagon Attack, specifically HAMMERTOSS malware downloaded from a public GitHub repository.

This week we’re releasing the second part of our APT29 (CozyBear) theme, the 2016 Democratic National Committee hack. As with the previous chain, due to sensitivity of the target, many details of the incident are not publicly known. However, for this release we’ve focused on the use of SeaDuke malware confirmed by Crowdstrike to have been used during the DNC hack.

SeaDuke

SeaDuke malware was used extensively by APT29 up to and including the timeframe of the DNC hack. It’s a secondary backdoor, known to be staged by a prior CozyDuke infection, with a simple feature set. The malware is written in Python, compiled using PyInstaller (and may be cross-compiled for Linux targets), and UPX packed. Since it’s written in Python it can be decompiled to source from the Python bytecode files.

Self-extracting RAR

APT29 is known to use multistage malware delivered via spearphishing. For this release, we’re demonstrating malware delivery in a self-extracting RAR file. Once the self-extracting RAR is executed it automatically extracts our disarmed SeaDuke malware. Next, we create a malicious .LNK file which is used to execute the malware. The final step in our chain is to collect and stage emails for exfiltration.

Check it out on the Prelude chains website.

Watch a demonstration:

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

f33d by Prelude