Application Layer Protocol: Mail Protocols

Agent Tesla has used SMTP for C2 communications.^[2][3][4]

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.^[1][5]

APT32 has used email for C2 via an Office macro.^[6][7]

BadPatch uses SMTP for C2.^[8]

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.^[9]

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.^[10]

ComRAT can use email attachments for command and control.^[11]

CORESHELL can communicate over SMTP and POP3 for C2.^[1][12]

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[7]

IMAPLoader uses the IMAP email protocol for command and control purposes.^[13]

JPIN can send email over SMTP.^[14]

Kimsuky has used e-mail to send exfiltrated data to C2 servers.^[15]

LightNeuron uses SMTP for C2.^[16]

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).^[17]

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.^[18]

NightClub can use emails for C2 communications.^[19]

OLDBAIT can use SMTP for C2.^[1]

RDAT can use email attachments for C2 communications.^[20]

Remsec is capable of using SMTP for C2.^{[21][22][23][24]}

SilverTerrier uses SMTP for C2 communications.^[25]

A SUGARDUMP variant used SMTP for C2.^[26]

Turla has used multiple backdoors which communicate with a C2 server via email attachments.^[27]

Uroburos can use custom communications protocols that ride over SMTP.^[28]

Zebrocy uses SMTP and POP3 for C2.^{[29][9][30][31][32]}

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.