H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Seasalt

[Seasalt](https://attack.mitre.org/software/S0345) is malware that has been linked to [APT1](https://attack.mitre.org/groups/G0006)'s 2010 operations. It shares some code similarities with [OceanSalt](https://attack.mitre.org/software/S0346).(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Seasalt](https://attack.mitre.org/software/S0345) is malware that has been linked to [APT1](https://attack.mitre.org/groups/G0006)'s 2010 operations. It shares some code similarities with [OceanSalt](https://attack.mitre.org/software/S0346).(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)

Labels

malware
11 recorded

Relationships

uses
from APT1
Group
uses
to Encrypted/Encoded File
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Masquerade Task or Service
Technique
uses
to Process Discovery
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Service
Technique
4 external

References

mitre-attack
S0345
open
Seasalt
—
Mandiant APT1 Appendix
https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf
open
McAfee Oceansalt Oct 2018
https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance