# SleepyDuck

> As of 2026-11-09, SleepyDuck is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning supply chain. Also known as EtherDuck operator. ATT&CK coverage spans 22 techniques across 10 tactics in 2 of 2 tracked threats. Most-observed techniques: T1036 (Masquerading), T1059.001 (PowerShell), T1059.004 (Unix Shell).

- **Tracked threats:** 2
- **Categories:** SUPPLY_CHAIN
- **Also known as:** EtherDuck operator
- **As of:** 2026-11-09

## ATT&CK techniques observed

22 techniques observed across 2 of 2 tracked threats. Tactics: Stealth (formerly Defense Evasion) (4), Command and Control (3), Defense Impairment (3), Execution (3), Persistence (3), Initial Access (2).

- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1059.001](https://intel.threadlinqs.com/technique/T1059.001) PowerShell — Execution — observed in 2 of 2 tracked threats
- [T1059.004](https://intel.threadlinqs.com/technique/T1059.004) Unix Shell — Execution — observed in 2 of 2 tracked threats
- [T1059.007](https://intel.threadlinqs.com/technique/T1059.007) Command and Scripting Interpreter — Execution — observed in 2 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1102.001](https://intel.threadlinqs.com/technique/T1102.001) Dead Drop Resolver — Command and Control — observed in 2 of 2 tracked threats
- [T1195.002](https://intel.threadlinqs.com/technique/T1195.002) Supply Chain Compromise — Initial Access — observed in 2 of 2 tracked threats
- [T1219](https://intel.threadlinqs.com/technique/T1219) Remote Access Tools — Command and Control — observed in 2 of 2 tracked threats
- [T1543.001](https://intel.threadlinqs.com/technique/T1543.001) Create or Modify System Process: Launch Agent — Persistence — observed in 2 of 2 tracked threats
- [T1543.002](https://intel.threadlinqs.com/technique/T1543.002) Systemd Service — Persistence — observed in 2 of 2 tracked threats
- [T1543.003](https://intel.threadlinqs.com/technique/T1543.003) Create or Modify System Process: Windows Service — Persistence — observed in 2 of 2 tracked threats
- [T1548.002](https://intel.threadlinqs.com/technique/T1548.002) Abuse Elevation Control Mechanism: Bypass User Account Control — Privilege Escalation — observed in 2 of 2 tracked threats
- [T1552.004](https://intel.threadlinqs.com/technique/T1552.004) Unsecured Credentials: Private Keys — Credential Access — observed in 2 of 2 tracked threats
- [T1553.002](https://intel.threadlinqs.com/technique/T1553.002) Code Signing — Defense Impairment — observed in 2 of 2 tracked threats

## Tracked threats

- [Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 Supply-Chain Compromise Delivers Wallet-Stealing Malware and Backdoors](https://intel.threadlinqs.com/threat/TL-2026-5576) — CRITICAL
- [Malicious @ethersphere/bee-js 13.3.0 npm Release and Swarm Desktop 0.56.2 Deliver SleepyDuck Ethereum C2 Backdoor](https://intel.threadlinqs.com/threat/TL-2026-5566) — CRITICAL

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/SleepyDuck