APT29 Democratic National Committee

Stage a self-extracting RAR that contains disarmed CozyBear malware. Next, use a malicious .LNK file to simulate user execution of the malware. Finally, stage emails for exfiltration.

2022-03-01

Professional

Authors:vvx7, mitre, khyberspache

TTP Tuesday: APT29 - 2016 Democratic National Committee

Stage and Execute SeaDuke Malware

Theme Overview

Our last release looked at the 2015 Pentagon Attack, specifically HAMMERTOSS malware downloaded from a public GitHub repository.

This week we’re releasing the second part of our APT29 (CozyBear) theme, the 2016 Democratic National Committee hack. As with the previous chain, due to sensitivity of the target, many details of the incident are not publicly known. However, for this release we’ve focused on the use of SeaDuke malware confirmed by Crowdstrike to have been used during the DNC hack.

SeaDuke

SeaDuke malware was used extensively by APT29 up to and including the timeframe of the DNC hack. It’s a secondary backdoor, known to be staged by a prior CozyDuke infection, with a simple feature set. The malware is written in Python, compiled using PyInstaller (and may be cross-compiled for Linux targets), and UPX packed. Since it’s written in Python it can be decompiled to source from the Python bytecode files.

Self-extracting RAR

APT29 is known to use multistage malware delivered via spearphishing. For this release, we’re demonstrating malware delivery in a self-extracting RAR file. Once the self-extracting RAR is executed it automatically extracts our disarmed SeaDuke malware. Next, we create a malicious .LNK file which is used to execute the malware. The final step in our chain is to collect and stage emails for exfiltration.

Watch a demonstration: APT29 DNC Hack

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Source: https://feed.prelude.org

Execute this chain

Download Operator (1.7.1)

Learn about Operator

TTPs

Self-extracting RAR malware

Create malicious .LNK file

Collect E-mail data

Other chains in this theme

ExBox

2022-03-29

Emulating RNC hack in 2021

APT29 COVID-19 Vaccine Data

2022-03-22

Emulating APT29's WellMess malware targeting vaccine research.

Operation Ghost

2022-03-15

Emulating APT 29 malware loader via steganography.

PolarCalm

2022-03-08

Emulating Cozy Bear's (APT29) supply chain attack.

About PreludePrelude hardens an organization's defenses by continuously “asking” it questions through the form of safe cyberattacks. These attacks respond immediately to the latest vulnerabilities and cyber events, turning complex technical descriptions into deployable “questions”.Our mission is to increase the reach, frequency and usage of advanced security for all organizations.

Follow @preludeorg on Twitter for new chains and more.

Join the Prelude Discord to discuss chains and more.

Keep up to date with code changes and community activity on Github

preludesecurity.com Careers Tactics & Techniques Attack themes

Privacy Policy support@preludesecurity.com© 2023 Prelude Research, Inc.All rights reserved. Prelude, its logo and other trademarks are trademarks of Prelude Research, Inc. and may not be used without permission.