Our last release looked at the 2015 Pentagon Attack, specifically HAMMERTOSS malware downloaded from a public GitHub repository.
This week we’re releasing the second part of our APT29 (CozyBear) theme, the 2016 Democratic National Committee hack. As with the previous chain, due to sensitivity of the target, many details of the incident are not publicly known. However, for this release we’ve focused on the use of SeaDuke malware confirmed by Crowdstrike to have been used during the DNC hack.
SeaDuke malware was used extensively by APT29 up to and including the timeframe of the DNC hack. It’s a secondary backdoor, known to be staged by a prior CozyDuke infection, with a simple feature set. The malware is written in Python, compiled using PyInstaller (and may be cross-compiled for Linux targets), and UPX packed. Since it’s written in Python it can be decompiled to source from the Python bytecode files.
APT29 is known to use multistage malware delivered via spearphishing. For this release, we’re demonstrating malware delivery in a self-extracting RAR file. Once the self-extracting RAR is executed it automatically extracts our disarmed SeaDuke malware. Next, we create a malicious .LNK file which is used to execute the malware. The final step in our chain is to collect and stage emails for exfiltration.
Watch a demonstration: APT29 DNC Hack
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg