SeaDuke

MITRE ATT&CK: S0053 View on attack.mitre.org

Aliases: SeaDaddy, SeaDesk, SeaDuke, Seadask

First seen
2014-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Last IoC activity
2026-07-17 17:16:23
Profile updated
2026-07-07 15:44:20

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:uk

Context

SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar.

Detection coverage

  • 430 Sigma rules

Malware & tools used

  • Pass the Ticket (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Valid Accounts (attack-pattern)
  • Archive via Library (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • File Deletion (attack-pattern)
  • Remote Email Collection (attack-pattern)
  • Software Packing (attack-pattern)
  • Web Protocols (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Shortcut Modification (attack-pattern)
  • PowerShell (attack-pattern)
  • Windows Management Instrumentation Event Subscription (attack-pattern)
  • Windows Command Shell (attack-pattern)

Used by threat actors

Reports & references

  • CrowdStrike — Bears Midst Intrusion Democratic National Committee (report)
  • f-secure.com — Dukes Whitepaper (report)
  • contagiodump.blogspot.de — Russian Apt Apt28 Collection Of Samples (report)
  • cyborgsecurity.com — Python Malware On The Rise (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Seadaddy (report)
  • Palo Alto Unit 42 — Unit 42 Technical Analysis Seaduke (report)
  • Broadcom/Symantec — Viewdocument (report)
  • MITRE ATT&CK — S0053 (report)

External references