SnappyTCP — Malware Profile

SnappyTCP is a web shell used by Sea Turtle between 2021 and 2023 against multiple victims. SnappyTCP appears to be based on a public GitHub project that has since been removed from the code-sharing site. SnappyTCP includes a simple reverse TCP shell for Linux and Unix environments with basic command and control capabilities.

MITRE ATT&CK techniques (5)

• T1059.004 Unix Shell
• T1071.001 Web Protocols
• T1095 Non-Application Layer Protocol
• T1505.003 Web Shell
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• Sea Turtle

Read the full analysis on IntelFusions