Application Layer Protocol: Mail Protocols

Agent Tesla has used SMTP for C2 communications.^[4][5][6]

APT28 used SMTP as a communication channel in various implants, initially using self-registered Google Mail accounts and later compromised email servers of its victims.^[9]

APT32 has used email for C2 via an Office macro.^[23][20]

BadPatch uses SMTP for C2.^[7]

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.^[1]

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.^[8]

ComRAT can use email attachments for command and control.^[21]

CORESHELL can communicate over SMTP and POP3 for C2.^[9][10]

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[20]

JPIN can send email over SMTP.^[11]

LightNeuron uses SMTP for C2.^[3]

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.^[2]

OLDBAIT can use SMTP for C2.^[9]

Remsec is capable of using SMTP for C2.^[12][13][14]

SilverTerrier uses SMTP for C2 communications.^[22]

Zebrocy uses SMTP and POP3 for C2.^{[15][1][16][17][18][19]}

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.