Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AlphaSeed is a malware developed in Golang and supports similar features to AppleSeed such as command execution and infostealing.
On 17 May 2023, we disclosed information about AlphaSeed, a new Go-based malware from the SeedpuNK group.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The group usually launches spear phishing attacks against national defense, defense industries, media, diplomacy, national organizations, and academic sectors.
HappyDoor in this case is also being distributed via an email attachment just like the previous method of distribution. This attachment file contains a compressed file, and the latter carries a JScript or a dropper (executable file). Once that is run, HappyDoor is created and executed along with normal bait files.
AppleSeed is a backdoor that can receive the threat actor’s commands from the C&C server and execute the received commands.
The discovered JSE file drops two additional pieces of malware encoded in Base64 and executes them through PowerShell commands.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Golang malware related to AppleSeed that supports command execution and information theft. It communicates with C2 using ChromeDP and email protocols, uses cookies for account login, and is installed similarly to AppleSeed via regsvr32.
A Golang malware attributed with high confidence to Kimsuky that uses embedded Naver session cookies and ChromeDP to access Naver Mail as a mail-based C2 channel. It persists via registry Run keys, executes through regsvr32, collects host data, performs keylogging and screenshots, encrypts/exfiltrates stolen data, and retrieves encrypted commands from attacker-controlled mailboxes.
Go-based AppleSeed variant/backdoor that persists via registry, collects keylogs and screenshots, uses Naver Mail as C2 via chromedp, decrypts commands with RSA+RC4, and can execute commands, load DLLs, create files, and steal/compress victim files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.