SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.seaspy (Back to overview)

SEASPY

According to CISA, this malware is a persistent backdoor that masquerades as a legitimate Barracuda Networks service. The malware is designed to listen to commands received from the Threat Actor’s Command-and-Control through TCP packets. When executed, the malware uses libpcap sniffer to monitor traffic for a magic packet on TCP port 25 (SMTP) and TCP port 587. It checks the network packet captured for a hard-coded string. When the right sequence of packet is captured, it establishes a TCP reverse shell to the C2 server for further exploitation. This allows the TA to execute arbitrary commands on the compromised system.
The malware is based on an open-source backdoor program named "cd00r".

References
2025-01-23 ⋅ Lumen ⋅ Black Lotus Labs
The J-Magic Show: Magic Packets and Where to find them
J-Magic SEASPY
2024-08-24 ⋅ YouTube (Black Hat) ⋅ Charles Li, Che Chang, Greg Chen
Chinese APT: A Master of Exploiting Edge Devices (Video)
SEASPY UNC4841
2024-04-19 ⋅ TEAMT5 ⋅ Charles Li, Che Chang, Greg Chen
Chinese APT: A Master of Exploiting Edge Devices
SEASPY UNC4841
2023-09-23 ⋅ Mandiant ⋅ Fernando Tomlinson, Nader Zaveri
Special Delivery: Defending and Investigating Advanced Intrusions on Secure Email Gateways
SALTWATER SEASPY WHIRLPOOL UNC4841
2023-08-23 ⋅ Mandiant ⋅ Fernando Tomlinson, Nader Zaveri
Special Delivery! Defending and Investigating Advanced Intrusions on Secure Email Gateways
SALTWATER SEASPY WHIRLPOOL UNC4841
2023-08-08 ⋅ CISA ⋅ CISA
MAR-10454006.r4.v2 SEASPY and WHIRLPOOL Backdoors
SEASPY WHIRLPOOL UNC4841
2023-07-28 ⋅ CISA ⋅ CISA
CISA Releases Malware Analysis Reports on Barracuda Backdoors
SEASPY
2023-07-28 ⋅ CISA ⋅ CISA
MAR-10454006-r2.v1 SEASPY Backdoor
SEASPY
2023-07-27 ⋅ CISA ⋅ CISA
MAR-10454006-r2.v1 SEASPY Backdoor
SEASPY UNC4841
2023-07-18 ⋅ Mandiant ⋅ Mandiant Intelligence
Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection
BPFDoor SALTWATER SEASPY SideWalk ZuoRAT Daxin HyperBro HyperSSL Waterbear
2023-06-15 ⋅ Mandiant ⋅ Austin Larsen, John Palmisano, John Wolfram, Mathew Potaczek, Matthew McWhirt
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China
SALTWATER SEASPY UNC4841
2023-06-15 ⋅ Google ⋅ Alyssa Glickman, Austin Larsen, Fernando Tomlinson, Jakub Jozwiak, John Palmisano, John Wolfram, Josh Villanueva, Mathew Potaczek, Matthew McWhirt
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China
SALTWATER SEASPY WHIRLPOOL UNC4841

There is no Yara-Signature yet.