Sedkit
Sedkit is a custom exploit kit used exclusively by the Sednit threat group, also tracked as APT28, Fancy Bear, and Sofacy, to gain initial access in targeted espionage operations. Reporting describes it as one of Sednit’s three main initial attack methods alongside fake webmail credential-harvesting pages and malicious email attachments. Sedkit was used to deliver the first-stage malware Seduploader, which then performed reconnaissance, established persistence and outbound connectivity, and commonly fetched second-stage payloads such as Xagent or Sedreco. Sedkit was active by at least September 2014 and was later used in targeted email campaigns through 2016; the last observed campaign in the provided reporting was in October 2016, after which activity disappeared.
Operationally, Sedkit was first observed in a watering-hole style campaign in which legitimate websites, including sites belonging to a large financial institution in Poland, were modified with injected IFRAMEs that redirected visitors to exploit-kit infrastructure. Later campaigns relied mainly on spearphishing emails containing links that mimicked legitimate news sites such as Stratfor, Reuters, The Guardian, Huffington Post, BBC, and UNIAN. Sedkit landing pages fingerprinted victims by collecting browser properties, installed plugins, screen properties, and time zone information before deciding whether to serve an exploit. It redirected both exploited and non-selected visitors to legitimate websites to reduce suspicion. In observed chains, Sedkit targeted Internet Explorer and Adobe Flash; one report notes Chrome and Firefox test traffic being redirected to localhost and that Java targeting was not used in the observed chain.
The exploit kit was reported exploiting CVE-2013-1347, CVE-2013-3897, CVE-2014-1510, CVE-2014-1511, CVE-2014-1776, CVE-2014-6332, CVE-2015-2590, CVE-2015-3043, CVE-2015-4902, CVE-2015-5119, and CVE-2015-7645, and also abusing MacKeeper on OS X. ESET assessed that Sednit developed a custom exploit for CVE-2014-6332. In one 2014 observed chain, successful exploitation downloaded a loader named runrun.exe, which installed splm.dll, an Xagent-related payload with modules for execution management, keylogging, file access, and communications. Reported command-and-control domains for that payload included msonlinelive.com, windows-updater.com, and azureon-line.com. Additional infrastructure noted in the observed redirection chain included defenceiq.us, cntt.akcdndata.com, armypress.org, mfapress.org, mfapress.com, and caciltd.com, with several resolving to 76.73.47.90.
Sedkit was associated with Sednit’s long-running targeting of governments, embassies, ministries of foreign affairs, political parties, defense-related entities, and other geopolitical targets, with a particular focus on Eastern Europe and broader diplomatic targets. Reporting specifically notes campaigns against embassies and political parties in Central Europe and broader Sednit targeting of government and geopolitical organizations worldwide.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | Table 3. Sedkit exploited vulnerabilities: CVE-2014-1776 Internet Explorer 11.
Table 3. Sedkit exploited vulnerabilities: CVE-2014-1510 / CVE-2014-1511 Firefox. | The second main attack method of the Sednit group is an exploit kit, which we named Sedkit.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | Table 3. Sedkit exploited vulnerabilities: CVE-2015-5119 Adobe Flash. Revamped from Hacking Team leaked data.
The vulnerability CVE-2014-6332 was discovered in May 2014... Soon after the disclosure, a proof-of-concept was released... in October 2015 a simple revamped version of the original proof-of-concept was added to Sedkit. But the Sednit group went one step further in February 2016 by deploying a different exploit for this vulnerability. | The second main attack method of the Sednit group is an exploit kit, which we named Sedkit.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | CVE-2015-4902 Java 0-day at the time Sedkit used it.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | CVE-2015-7645 Adobe Flash 0-day at the time Sedkit used it.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | Table 3. Sedkit exploited vulnerabilities: CVE-2013-1347 Internet Explorer 8.
CVE-2015-2590 Java 0-day at the time Sedkit used it. | The second main attack method of the Sednit group is an exploit kit, which we named Sedkit.
The second main attack method of the Sednit group is an exploit kit, which we named Sedkit. | CVE-2015-3043 Adobe Flash 0-day at the time Sedkit used it.
Table 3. Sedkit exploited vulnerabilities: CVE-2014-1510 / CVE-2014-1511 Firefox. | The second main attack method of the Sednit group is an exploit kit, which we named Sedkit.
Table 3. Sedkit exploited vulnerabilities: CVE-2013-3897 Internet Explorer 8. | The second main attack method of the Sednit group is an exploit kit, which we named Sedkit.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Spear phishing campaigns or the SedKit exploit kit delivered the Seduploader first stage.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
4 techniques
Initial Access
“potential victims were redirected to its landing page through a watering-hole scheme.” / “exploit kits… perform drive-by downloads.”
“Sednit leveraged vulnerabilities… mostly Adobe Flash and Internet Explorer.” / “DealersChoice… embedded Adobe Flash Player exploits… selects one of three different vulnerabilities.”
“potential victims were redirected to its landing page through a watering-hole scheme… their preferred method consisted of malicious links embedded in emails… using popular stories… and redirecting targets that click on the emailed URL to the real website, but not before visiting the Sedkit landing page.” | “The attack usually starts with an email containing either a malicious link or malicious attachment.” / “their preferred method consisted of malicious links embedded in emails sent to Sednit’s targets.”
Execution
1 technique
Execution
One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities... CVE-2015-2424 Office RCE, CVE-2015-3043 Flash, CVE-2015-1701 Windows LPE, CVE-2015-2590 Java, CVE-2015-4902 Java click-to-play bypass, CVE-2015-7645 Flash.
Command and Control
1 technique
Command and Control
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An exploit kit used to deliver the Seduploader first stage in APT28 intrusion chains.
Custom exploit kit attributed to Sednit used for watering-hole style redirections; fingerprints browser/plugins and serves a single Internet Explorer exploit per visit to deliver a payload.
A Sednit exploit kit referenced as a deployment mechanism for Xagent.
Custom exploit kit used in targeted attacks and watering-hole/phishing operations to fingerprint visitors, selectively deliver browser/plugin exploits, and then download and execute Sednit malware, usually Seduploader’s dropper.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.