Procedure examples

PowerExchange can receive and send back the results of executed C2 commands through email.

OLDBAIT can use SMTP for C2.

IMAPLoader uses the IMAP email protocol for command and control purposes.

RDAT can use email attachments for C2 communications.

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.

CORESHELL can communicate over SMTP and POP3 for C2.

Remsec is capable of using SMTP for C2.

LightNeuron uses SMTP for C2.

Uroburos can use custom communications protocols that ride over SMTP.

NightClub can use emails for C2 communications.

BadPatch uses SMTP for C2.

A SUGARDUMP variant used SMTP for C2.

Zebrocy uses SMTP and POP3 for C2.

LunarMail can communicates with C2 using email messages via the Outlook Messaging API (MAPI).

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.

Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.

ComRAT can use email attachments for command and control.

JPIN can send email over SMTP.

Agent Tesla has used SMTP for C2 communications.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.