MalwareUsed by 3 actors

SeaDuke

Also known asSeaDaddySeaDesk

SeaDuke is a stealthy Duke-family backdoor and information-stealing Trojan associated with APT29, also known as Cozy Bear or The Dukes. It has been used in targeted cyberespionage operations against a small number of high-value victims, particularly governmental, diplomatic, policy, and research organizations in the United States and Europe. SeaDuke is closely related to variants and aliases including SeaDaddy and SeaDesk, and has been observed as a Python-based framework compiled into Windows executables, with at least one Linux variant also reported.

SeaDuke is typically deployed after an earlier foothold, including installation from CozyDuke or CozyCar infections. APT29 has used encoded PowerShell scripts to download and install SeaDuke as a follow-on payload, indicating its role as a selective second-stage implant for more valuable victims. Once installed, it supports persistence through Windows Run-key autostart and Startup-folder shortcut mechanisms, and some reporting also notes PowerShell-assisted persistence.

Functionally, SeaDuke operates as a command-driven backdoor. It can execute system commands, upload and download files, gather system information, evaluate additional code, update configuration, migrate processes, and uninstall or self-delete. Its self-removal capability is notably implemented through a function referred to as seppuku. SeaDuke has also been documented using a module to invoke Mimikatz through PowerShell for Kerberos pass-the-ticket activity, extending its utility into credential abuse and post-compromise operations. Related operator workflows have included email theft from Exchange, archiving of sensitive data, exfiltration through legitimate cloud services, and secure deletion of artifacts.

The malware is notable for layered obfuscation and protected communications. Analyses have described PyInstaller packaging, encoded and compressed embedded code, and heavily obfuscated Python logic. Its command-and-control traffic has been observed over HTTP and HTTPS, using Base64 encoding together with RC4 and AES encryption, and in some samples encrypted data is embedded within HTTP cookies and parsed from structured server responses. SeaDuke can discard malformed command data and enter a sleep cycle, reflecting operational resilience and controlled tasking.

SeaDuke is regarded as a low-profile but sophisticated espionage implant requiring substantial preparation and operational support. Its selective deployment, encrypted communications, persistence options, anti-forensic self-deletion, and integration into broader APT29 intrusion chains make it a notable component of Russian state-linked cyberespionage tradecraft.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

via mitre attack websiteattack.mitre.org

Office Monkeys

Seaduke (detected by Symantec as Trojan.Seaduke) is a low-profile information-stealing Trojan which appears to be reserved for attacks against a small number of high-value targets.

via broadcom communitycommunity.broadcom.com

EuroAPT

Seaduke (detected by Symantec as Trojan.Seaduke) is a low-profile information-stealing Trojan which appears to be reserved for attacks against a small number of high-value targets.

via broadcom communitycommunity.broadcom.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

Other alternatives include using a universal scripting language, such as Python, to write their codebase. This was seen previously by the Chafer threat group that wrote one of their payloads in Python.

T1059.001PowerShellEvidence6

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands. | AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence2

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence6

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

T1547.009Shortcut ModificationEvidence3

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.

Privilege Escalation

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence2

T1547.001Registry Run Keys / Startup FolderEvidence6

T1547.009Shortcut ModificationEvidence3

Stealth

3 techniques

T1027.002Software PackingEvidence1

they must rely on packaging them using a utility such as PyInstaller.

T1070Indicator RemovalEvidence2

They have the ability to retrieve detailed bot/system information, update bot configuration, upload files, download files, and self-delete the malware from the system.

T1070.004File DeletionEvidence5

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Credential Access

1 technique

T1003OS Credential DumpingEvidence2

GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

They have the ability to retrieve detailed bot/system information, update bot configuration, upload files, download files, and self-delete the malware from the system.

T1083File and Directory DiscoveryEvidence1

They have the ability to retrieve detailed bot/system information, update bot configuration, upload files, download files, and self-delete the malware from the system.

Lateral Movement

1 technique

T1550.003Pass the TicketEvidence3

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.

Command and Control

6 techniques

T1001Data ObfuscationEvidence1

The communication protocol employed had many layers of encryption and obfuscation... Seaduke securely communicates with the C&C server over HTTP/HTTPS beneath layers of encoding (Base64) and encryption (RC4, AES).

T1071Application Layer ProtocolEvidence1

The centerpiece is a server-oriented Linux kernel rootkit that hooks netfilter traffic control functions in order to enable firewall-traversing covert C2 (command-and-control) communications.

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The malware hides behind numerous layers of encryption and obfuscation and is capable of quietly stealing and exfiltrating sensitive information such as email from the victim’s computer.

ACTIVITY FEED

Recent activity

47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

47 SOURCESView more in app

nuclei templates pull requestsNews

Jan 9, 2026

Fix reference list formatting in SeaDuke malware hash template

Seaduke is a specific malware family, often associated with advanced persistent threat (APT) operations. It is known for its use in targeted cyber espionage campaigns.

cyble blogNews

Feb 20, 2025

Threat Actor Profile: APT29 - Cyble

A Python-based cross-platform backdoor for Windows and Linux that executes C2 commands, transfers files, and runs additional code.

vulncheck blogNews

Feb 15, 2024

Reimagining How We Think About Threat Actors

SeaDuke is a backdoor malware used by APT29/Cozy Bear for espionage operations.

vulncheck blogNews

Feb 15, 2024

Reimagining How We Think About Threat Actors

SeaDuke is a backdoor malware used by APT29/Cozy Bear for espionage operations.

+43 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SeaDuke

Also known asSeaDaddySeaDesk