MalwareUsed by 1 actorExploits 5 CVEs

DealersChoice

DealersChoice is a malicious-document framework/platform used by the Sednit threat group, also known as APT28, Fancy Bear, Sofacy, and Strontium. It is designed to generate malicious documents with embedded Adobe Flash Player exploits and leverages vulnerable versions of Flash to achieve code execution on victim systems. Reporting cited in the content describes two variants: a standalone form containing exploit code and payload, and a modular form that loads exploit code or payload on demand from command-and-control infrastructure. DealersChoice has been observed using HTTP for communication with its C2 server. The platform was used intensively by Sednit in late 2016, remained in use afterward, and was later observed again in 2017 and in updated form against embassies and EU agencies. Email attachments are described as a main entry point into the Sednit ecosystem, and DealersChoice was specifically associated with targeted phishing campaigns against ministries of foreign affairs, embassies, political parties, and other government-related entities. The content also notes that DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

5 CVES

CVE-2016-7855Use-after-free Remote Code Execution in Adobe Flash PlayerExploited in the wild

DealersChoice has previously been used to exploit a variety of Flash vulnerabilities, including CVE-2015-7645, CVE-2016-1019, CVE-2016-4117, and CVE-2016-7855 via embedded objects in crafted Microsoft Word documents.

via proofpoint threat insight blogproofpoint.com

CVE-2015-7645Remote Code Execution in Adobe Flash Player via Crafted SWFExploited in the wild

via proofpoint threat insight blogproofpoint.com

CVE-2016-4117Adobe Flash Player Use-After-Free Remote Code ExecutionExploited in the wild

via proofpoint threat insight blogproofpoint.com

CVE-2016-1019Adobe Flash Player remote code execution vulnerabilityExploited in the wild

via proofpoint threat insight blogproofpoint.com

CVE-2017-11292Adobe Flash Player type confusion in bytecode verification

"...a new platform used by Sednit... which they called DealersChoice, has the ability to generate malicious documents with embedded Adobe Flash Player exploits."

via eset welivesecurity blogwelivesecurity.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT28

"...a new platform used by Sednit... which they called DealersChoice, has the ability to generate malicious documents with embedded Adobe Flash Player exploits."

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1190Exploit Public-Facing ApplicationEvidence1

“Sednit leveraged vulnerabilities… mostly Adobe Flash and Internet Explorer.” / “DealersChoice… embedded Adobe Flash Player exploits… selects one of three different vulnerabilities.”

T1566.001Spearphishing AttachmentEvidence1

“The DealersChoice exploit platform… has the ability to generate malicious documents with embedded Adobe Flash Player exploits… lure the target into opening the malicious document attachment.”

T1566.002Spearphishing LinkEvidence1

“The attack usually starts with an email containing either a malicious link or malicious attachment.” / “their preferred method consisted of malicious links embedded in emails sent to Sednit’s targets.”

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

T1203Exploitation for Client ExecutionEvidence4

"...leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website." / "...has exploited client software vulnerabilities for execution..." / "...has used multiple software exploits for common client software...to gain code execution."

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

“Seduploader… download additional malware.” / “the Seduploader binary is downloaded from the C&C server and executed” / “variant B… contact a C&C server which will deliver the selected exploit and the final malicious payload.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app9 years ago

ip.v4●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

securelistNews

Dec 5, 2018

APT review of the year

Sofacy-associated exploitation/delivery framework used in targeted operations against diplomatic/government entities.

eset welivesecurity blogNews

Jan 24, 2026

Zebrocy used heavily by the Sednit group over last two years

Sednit/APT28 tooling used in email-attachment-based intrusion chains (commonly referenced as an exploit framework for weaponized documents).

mitre attackNews

Jan 25, 2026

Exploitation for Client Execution, Technique T1203 - Enterprise | MITRE ATT&CK®

Malware/implant delivered via exploitation of vulnerable Adobe Flash versions to achieve code execution.

mitre attackNews

Jan 25, 2026

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®

Malware that uses HTTP to communicate with its C2 server.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities5

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DealersChoice