Application Layer Protocol: Mail Protocols

Agent Tesla has used SMTP for C2 communications.^[2][3][4]

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.^[1][5]

APT32 has used email for C2 via an Office macro.^[6][7]

BadPatch uses SMTP for C2.^[8]

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.^[9]

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.^[10]

ComRAT can use email attachments for command and control.^[11]

Contagious Interview has utilized email notifications from malware distribution servers to track victim engagement.^[12]

CORESHELL can communicate over SMTP and POP3 for C2.^[1][13]

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[7]

IMAPLoader uses the IMAP email protocol for command and control purposes.^[14]

JPIN can send email over SMTP.^[15]

Kimsuky has used e-mail to send exfiltrated data to C2 servers.^[16]

LightNeuron uses SMTP for C2.^[17]

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).^[18]

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.^[19]

NightClub can use emails for C2 communications.^[20]

OLDBAIT can use SMTP for C2.^[1]

PowerExchange can receive and send back the results of executed C2 commands through email.^[21]

RDAT can use email attachments for C2 communications.^[22]

Remsec is capable of using SMTP for C2.^{[23][24][25][26]}

SilverTerrier uses SMTP for C2 communications.^[27]

A SUGARDUMP variant used SMTP for C2.^[28]

Turla has used multiple backdoors which communicate with a C2 server via email attachments.^[29]

Uroburos can use custom communications protocols that ride over SMTP.^[30]

Zebrocy uses SMTP and POP3 for C2.^{[31][9][32][33][34]}

Limit the ability of servers and critical systems to initiate outbound email communications. Filtering SMTP/IMAP/POP3 traffic to only trusted mail servers reduces the risk of attackers using compromised systems to exfiltrate data via email or to receive commands from attacker-controlled email accounts.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.