MalwareUsed by 1 actor

SEASHARPEE

SEASHARPEE is an Iranian-associated web shell that enables command execution on compromised systems. It can manipulate file timestamps through timestomping, providing defense-evasion and anti-forensic functionality. Its source code was leaked in March 2019 through the Lab Dookhtegan Telegram channel. In April 2019, the Chinese cyberespionage group UNC215 deployed SEASHARPEE against financial and high-technology organizations in the Middle East and Asia. Its use by UNC215 demonstrates adoption of the leaked tooling outside its original Iranian-associated context.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

unc215

In April 2019, UNC215 deployed the SEASHARPEE web shell against financial and high-tech organizations in the Middle East and Asia.

via fireeyefireeye.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence5

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

1 technique

T1505.003Web ShellEvidence3

"CVE-2019-0604 was used to deliver web shells"; "pivoted to multiple OWA servers and installed web shells"

Stealth

1 technique

T1070.006TimestompEvidence3

APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK Techniques list includes "T1071.001 ... Web Protocols"; web shells and C2 over common protocols are implied.

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Sep 30, 2024

Indicator Removal: Timestomp, Sub-technique T1070.006 - Enterprise | MITRE ATT&CK®

Web shell malware capable of timestomping files on victim systems.

fireeyeNews

Aug 10, 2021

UNC215: Spotlight on a Chinese Espionage Campaign in Israel

Web shell (originally developed/used by Iranian APT actors prior to code leak) deployed for server-side access in UNC215 operations; used as part of post-exploitation tradecraft and likely for command execution and persistence on web servers.

mitre attack websiteNews

Apr 29, 2021

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Identified as a web shell; no specific capabilities or actor associations are stated.

mitre attackNews

Jan 24, 2026

Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise | MITRE ATT&CK®

Web shell used to maintain access on compromised servers.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SEASHARPEE