Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1071.003: Mail Protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1]

EnterpriseT1071.003Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Mail Protocols (T1071.003) matters because command-and-control traffic can hide inside email delivery protocols that many organizations already allow. The business issue is not just “email traffic exists,” but whether the organization can distinguish approved mail flows from systems using SMTP/S, POP3/S, or IMAP as a covert control channel across Linux, macOS, Windows, and network devices.

Executive priority

Prioritize this where email protocols are broadly permitted, where legacy applications send mail directly, or where network devices are allowed to communicate externally. Leaders should ask whether mail traffic is forced through approved infrastructure, whether SOC teams can see enough metadata to investigate suspicious mail-protocol use, and whether incident responders can quickly identify which host, process, or device initiated the connection. This supports resilience, audit evidence, and control prioritization because common protocols can otherwise create a high-noise blind spot.

Technical view

This is an enterprise command-and-control sub-technique affecting Linux, macOS, Windows, and network devices. ATT&CK provides no official detection text for this object, so validation should focus on local telemetry coverage and baselining: which assets are expected to use SMTP/SMTPS, POP3/POP3S, or IMAP; which destinations are approved; and whether endpoint or network logs can tie mail-protocol sessions back to a host and, where available, a process or device identity.

Likely telemetry

  • Firewall, proxy, and network flow logs showing SMTP/S, POP3/S, and IMAP traffic
  • Email gateway and mail server logs, including sender/recipient, header, connection, and authentication metadata where collected
  • Endpoint network connection telemetry from Linux, macOS, and Windows systems
  • Network device egress logs for devices that can initiate mail-protocol connections
  • TLS/session metadata where encrypted mail protocols limit content inspection

Detection direction

  • Build baselines for approved mail clients, servers, applications, and network devices that legitimately use mail protocols.
  • Look for direct outbound mail-protocol connections from hosts or devices that should only use central mail infrastructure.
  • Tune for unusual destinations, timing, volume, protocol use, or repeated connections inconsistent with normal email behavior.
  • Correlate network sessions with endpoint process telemetry where available to reduce false positives from legitimate mail clients and applications.
  • Account for blind spots from encrypted protocols, unmanaged assets, network devices with limited logging, and environments that permit direct SMTP/POP3/IMAP egress.

Mitigation priorities

  • Restrict mail-protocol egress to approved mail infrastructure where operationally feasible.
  • Inventory systems and network devices with legitimate mail-sending or mail-retrieval requirements.
  • Ensure mail gateway, firewall, and endpoint telemetry is retained and usable for investigation.
  • Review legacy applications or devices that bypass centralized email controls.
  • Document approved mail flows as compliance and incident-response evidence.
Analyst notes and limits

No relationship context or official detection guidance was supplied for this object. The defensive value comes from validating whether common email protocols are controlled, logged, and attributable to expected systems. Local architecture will determine whether inspection is possible or whether teams must rely primarily on metadata and baselines.

This take is based only on the supplied ATT&CK fields for T1071.003. It does not assert active exploitation, specific adversary attribution, customer exposure, or guaranteed detection coverage. Environment-specific mail architecture, logging depth, encryption handling, and asset inventory are required to assess actual risk.

Official MITRE ATT&CK definition

Mail Protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1071 Application Layer Protocol This object subtechnique of Application Layer Protocol.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Group Enterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Malware Enterprise

S0126: ComRAT

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.[1][2][3]

Windows
Malware Enterprise

S0395: LightNeuron

LightNeuron is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. LightNeuron has been used by Turla to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of LightNeuron exists.[1]

WindowsLinux
Malware Enterprise

S0023: CHOPSTICK

CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.

WindowsLinux
Malware Enterprise

S0022: Uroburos

Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]

LinuxWindowsmacOS
Malware Enterprise

S0125: Remsec

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. [1]

Windows
Malware Enterprise

S0247: NavRAT

NavRAT is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. [1]

Windows
Malware Enterprise

S0251: Zebrocy

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. [1][2][3][4]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S0126: ComRAT Enterprise uses · Malware S0395: LightNeuron Enterprise uses · Malware S0137: CORESHELL Enterprise uses · Malware S0337: BadPatch Enterprise uses · Malware S0023: CHOPSTICK Enterprise uses · Group G0010: Turla Enterprise uses · Malware S0022: Uroburos Enterprise uses · Malware S0201: JPIN Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise uses · Malware S0125: Remsec Enterprise uses · Malware S0247: NavRAT Enterprise uses · Group G0083: SilverTerrier Enterprise uses · Malware S0351: Cannon Enterprise uses · Malware S0251: Zebrocy Enterprise uses · Malware S0138: OLDBAIT Enterprise uses · Group G0050: APT32 Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise uses · Malware S0495: RDAT Enterprise uses · Malware S1090: NightClub Enterprise uses · Group G0007: APT28 Enterprise uses · Group G0094: Kimsuky Enterprise uses · Malware S1173: PowerExchange Enterprise detects · Detection Strategy DET0135: Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3) Enterprise subtechnique of · Technique T1071: Application Layer Protocol Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
3ac41f8492bef709...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle 3ac41f8492be…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  2. [2]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  3. [3]
    mitre-attack T1071.003
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use