Loading malware…
SEASHARPEE is an Iranian-associated web shell that enables command execution on compromised systems. It can manipulate file timestamps through timestomping, providing defense-evasion and anti-forensic functionality. Its source code was leaked in March 2019 through the Lab Dookhtegan Telegram channel. In April 2019, the Chinese cyberespionage group UNC215 deployed SEASHARPEE against financial and high-technology organizations in the Middle East and Asia. Its use by UNC215 demonstrates adoption of the leaked tooling outside its original Iranian-associated context.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In April 2019, UNC215 deployed the SEASHARPEE web shell against financial and high-tech organizations in the Middle East and Asia.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
"CVE-2019-0604 was used to deliver web shells"; "pivoted to multiple OWA servers and installed web shells"
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
MITRE ATT&CK Techniques list includes "T1071.001 ... Web Protocols"; web shells and C2 over common protocols are implied.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.