LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0345: Seasalt

Seasalt is malware that has been linked to APT1's 2010 operations. It shares some code similarities with OceanSalt.[1][2]

EnterpriseS0345MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Seasalt

Seasalt is malware that has been linked to APT1's 2010 operations. It shares some code similarities with OceanSalt.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

10 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.003Windows Command ShellSub-technique

Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.[1]

EnterpriseT1083File and Directory Discovery

Seasalt has the capability to identify the drive type on a victim.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Seasalt uses HTTP for C2 communications.[1]

EnterpriseT1057Process Discovery

Seasalt has a command to perform a process listing.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.[1]

EnterpriseT1105Ingress Tool Transfer

Seasalt has a command to download additional files.[1][1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Seasalt obfuscates configuration data.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Seasalt is capable of installing itself as a service.[1]

EnterpriseT1070.004File DeletionSub-technique

Seasalt has a command to delete a specified file.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0006: APT1

APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. [1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · GroupG0006: APT1Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.2
Created
Modified
Raw hash
b5f674885dba2eac...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.2Current bundleb5f674885dba…
19.21.2Older bundleb5f674885dba…
19.11.2Older bundleb5f674885dba…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Mandiant APT1 Appendix

    Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.

    Open source URL
  2. [2]
    McAfee Oceansalt Oct 2018

    Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.

    Open source URL
  3. [3]
    Seasalt

    (Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)

  4. [4]
    mitre-attackS0345
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use