APT29 Democratic National Committee

Stage a self-extracting RAR that contains disarmed CozyBear malware. Next, use a malicious .LNK file to simulate user execution of the malware. Finally, stage emails for exfiltration.

TTP Tuesday: APT29 - 2016 Democratic National Committee

Stage and Execute SeaDuke Malware

Theme Overview

Our last release looked at the 2015 Pentagon Attack, specifically HAMMERTOSS malware downloaded from a public GitHub repository.

This week we’re releasing the second part of our APT29 (CozyBear) theme, the 2016 Democratic National Committee hack. As with the previous chain, due to sensitivity of the target, many details of the incident are not publicly known. However, for this release we’ve focused on the use of SeaDuke malware confirmed by Crowdstrike to have been used during the DNC hack.


SeaDuke malware was used extensively by APT29 up to and including the timeframe of the DNC hack. It’s a secondary backdoor, known to be staged by a prior CozyDuke infection, with a simple feature set. The malware is written in Python, compiled using PyInstaller (and may be cross-compiled for Linux targets), and UPX packed. Since it’s written in Python it can be decompiled to source from the Python bytecode files.

Self-extracting RAR

APT29 is known to use multistage malware delivered via spearphishing. For this release, we’re demonstrating malware delivery in a self-extracting RAR file. Once the self-extracting RAR is executed it automatically extracts our disarmed SeaDuke malware. Next, we create a malicious .LNK file which is used to execute the malware. The final step in our chain is to collect and stage emails for exfiltration.

Watch a demonstration: APT29 DNC Hack

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Sam: wasupwithuman

Source: https://feed.prelude.org
Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator


Self-extracting RAR malware
Create malicious .LNK file
Collect E-mail data


apt29 scenario 2, apt29