Application Layer Protocol: Mail Protocols

Agent Tesla has used SMTP for C2 communications.^[1][2][3]

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.^[4][5]

APT32 has used email for C2 via an Office macro.^[6][7]

BadPatch uses SMTP for C2.^[8]

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.^[9]

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.^[10]

ComRAT can use email attachments for command and control.^[11]

CORESHELL can communicate over SMTP and POP3 for C2.^[4][12]

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[7]

JPIN can send email over SMTP.^[13]

Kimsuky has used e-mail to send exfiltrated data to C2 servers.^[14]

LightNeuron uses SMTP for C2.^[15]

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.^[16]

OLDBAIT can use SMTP for C2.^[4]

RDAT can use email attachments for C2 communications.^[17]

Remsec is capable of using SMTP for C2.^[18][19][20]

SilverTerrier uses SMTP for C2 communications.^[21]

Turla has used multiple backdoors which communicate with a C2 server via email attachments.^[22]

Zebrocy uses SMTP and POP3 for C2.^{[23][9][24][25][26][27]}

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.