Loading malware…
SeaDuke is a Python-based backdoor associated with APT29/COZY BEAR (The Dukes) and used in operations including the 2015–2016 DNC intrusion. It is also referred to as SeaDaddy, SeaDesk, and SeaDask, with reporting indicating SeaDaddy is effectively the same or a very closely related variant. Public reporting describes it as a secondary backdoor used on victims already compromised with CozyCar; APT29 used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.
SeaDuke was compiled as a Windows executable, including samples built with PyInstaller from Python code and packed with UPX. Reported samples used multiple obfuscation layers including base64 encoding and ZLIB compression. It communicates with command-and-control over HTTP, with code support for HTTPS also noted. C2 traffic has been described as base64-encoded and, in some reporting, encrypted with RC4 and AES. Unit 42 reported RC4 encryption using session keys derived from random strings hashed with SHA1, with encrypted data embedded in HTTP cookies and commands recovered from HTML-like server responses that were expected to decrypt into valid JSON.
Its core functionality is that of a straightforward backdoor that executes commands from its C2 server. Reported capabilities include system command execution, changing directories, file upload and download, retrieving files, process migration, cloning file timestamps, evaluating additional Python code, adjusting update intervals, and uninstall/self-termination. SeaDuke can securely delete files, including deleting itself; the self-delete function is referred to as "seppuku" in reporting. Some samples also included a module to extract email from Microsoft Exchange servers using compromised credentials and a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
Persistence mechanisms reported for SeaDuke include PowerShell-based persistence, the Windows Run registry key, a Startup-directory .lnk file, and WMI-based persistence. Reporting specifically notes use of a WMI event filter to execute a previously dropped executable shortly after system startup, and DNC-related reporting described a one-line PowerShell command abusing Windows Management Instrumentation to persist in the WMI database and execute on a schedule.
High-confidence sample/configuration details from Unit 42 include a sample labeled by some AV vendors as Trojan.Win32.Seadask with MD5 A25EC7749B2DE12C2A86167AFA88A4DD, SHA1 BB71254FBD41855E8E70F05231CE77FEE6F00388, and SHA256 3EB86B7B067C296EF53E4857A74E09F12C2B84B666FC130D1F58AEC18BC74B0D. Recovered configuration values included the C2 endpoint http://monitor.syn[.]cn/rss.php, referer https://www.facebook.com/, user-agent "SiteBar/3.3.8 (Bookmark Server; http://sitebar.org/)", key_id P4BNZR0, and autoload settings using the name LogonUI.exe.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Fidelis Reverse Engineering team noted that in the samples of “SeaDaddy,” that were provided to us from the DNC incident, there were nearly identical code obfuscation techniques and methods. In fact, once decompiled, the two programs were very similar in form and function. They both used identical persistence methods (Powershell, a RUN registry key, and a .lnk file stored in the Startup directory). | Palo Alto Networks provides some detailed reversing and analysis on other malware that they attributed to COZY BEAR named “SeaDuke.” The Fidelis Reverse Engineering team noted that in the samples of “SeaDaddy,” that were provided to us from the DNC incident, there were nearly identical code obfuscation techniques and methods.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Cozy Bear ran SeaDaddy (also known as SeaDuke, a backdoor developed in Python and compiled as a Windows executable) as well as a one-line Windows PowerShell command that exploited Microsoft’s Windows Management Instrumentation (WMI) system.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"
The exploit allowed attackers to persist in WMI’s database and execute based on a schedule.
Examples include: 'APT28 has deployed malware that has copied itself to the startup directory for persistence' and 'APT29 added Registry Run keys to establish persistence.'
"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"
The exploit allowed attackers to persist in WMI’s database and execute based on a schedule.
Examples include: 'APT28 has deployed malware that has copied itself to the startup directory for persistence' and 'APT29 added Registry Run keys to establish persistence.'
The malware samples contained complex coding structures and utilized obfuscation techniques that we have seen advanced adversaries utilize in other investigations we have conducted.
Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.
APT29 has used SDelete to remove artifacts from victim networks. FIN5 uses SDelete to clean up the environment and attempt to prevent detection. SDelete deletes data in a way that makes it unrecoverable. | The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
When the malware makes the initial outbound connection, a specific Cookie value is used... this Cookie value contains encrypted data... The server attempts to mimic a HTML page and provides base64-encoded data within the response... decrypted via RC4.
These actors set up operational infrastructure to obfuscate their source infrastructure, host domains and malware for targeting organizations, establish command and control nodes, and harvest credentials and other valuable information from their targets.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
The following commands have been identified in Seaduke... download Download file ... upload Upload file to specified URL
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Seaduke is a specific malware family, often associated with advanced persistent threat (APT) operations. It is known for its use in targeted cyber espionage campaigns.
A Python-based cross-platform backdoor for Windows and Linux that executes C2 commands, transfers files, and runs additional code.
SeaDuke is a backdoor malware used by APT29/Cozy Bear for espionage operations.
SeaDuke is a backdoor malware used by APT29/Cozy Bear for espionage operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.