LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1071.003: Mail Protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1]

EnterpriseT1071.003Sub-techniqueObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Mail Protocols (T1071.003) matters because command-and-control traffic can hide inside email delivery protocols that many organizations already allow. The business issue is not just “email traffic exists,” but whether the organization can distinguish approved mail flows from systems using SMTP/S, POP3/S, or IMAP as a covert control channel across Linux, macOS, Windows, and network devices.

Executive priority

Prioritize this where email protocols are broadly permitted, where legacy applications send mail directly, or where network devices are allowed to communicate externally. Leaders should ask whether mail traffic is forced through approved infrastructure, whether SOC teams can see enough metadata to investigate suspicious mail-protocol use, and whether incident responders can quickly identify which host, process, or device initiated the connection. This supports resilience, audit evidence, and control prioritization because common protocols can otherwise create a high-noise blind spot.

Technical view

This is an enterprise command-and-control sub-technique affecting Linux, macOS, Windows, and network devices. ATT&CK provides no official detection text for this object, so validation should focus on local telemetry coverage and baselining: which assets are expected to use SMTP/SMTPS, POP3/POP3S, or IMAP; which destinations are approved; and whether endpoint or network logs can tie mail-protocol sessions back to a host and, where available, a process or device identity.

Likely telemetry

  • Firewall, proxy, and network flow logs showing SMTP/S, POP3/S, and IMAP traffic
  • Email gateway and mail server logs, including sender/recipient, header, connection, and authentication metadata where collected
  • Endpoint network connection telemetry from Linux, macOS, and Windows systems
  • Network device egress logs for devices that can initiate mail-protocol connections
  • TLS/session metadata where encrypted mail protocols limit content inspection

Detection direction

  • Build baselines for approved mail clients, servers, applications, and network devices that legitimately use mail protocols.
  • Look for direct outbound mail-protocol connections from hosts or devices that should only use central mail infrastructure.
  • Tune for unusual destinations, timing, volume, protocol use, or repeated connections inconsistent with normal email behavior.
  • Correlate network sessions with endpoint process telemetry where available to reduce false positives from legitimate mail clients and applications.
  • Account for blind spots from encrypted protocols, unmanaged assets, network devices with limited logging, and environments that permit direct SMTP/POP3/IMAP egress.

Mitigation priorities

  • Restrict mail-protocol egress to approved mail infrastructure where operationally feasible.
  • Inventory systems and network devices with legitimate mail-sending or mail-retrieval requirements.
  • Ensure mail gateway, firewall, and endpoint telemetry is retained and usable for investigation.
  • Review legacy applications or devices that bypass centralized email controls.
  • Document approved mail flows as compliance and incident-response evidence.
Additional notes and limits

No relationship context or official detection guidance was supplied for this object. The defensive value comes from validating whether common email protocols are controlled, logged, and attributable to expected systems. Local architecture will determine whether inspection is possible or whether teams must rely primarily on metadata and baselines.

This take is based only on the supplied ATT&CK fields for T1071.003. It does not assert active exploitation, specific adversary attribution, customer exposure, or guaranteed detection coverage. Environment-specific mail architecture, logging depth, encryption handling, and asset inventory are required to assess actual risk.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Mail Protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1071Application Layer ProtocolThis object subtechnique of Application Layer Protocol.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

GroupEnterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

GroupEnterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

MalwareEnterprise

S0126: ComRAT

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.[1][2][3]

Windows
MalwareEnterprise

S0395: LightNeuron

LightNeuron is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. LightNeuron has been used by Turla to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of LightNeuron exists.[1]

WindowsLinux
MalwareEnterprise

S0023: CHOPSTICK

CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.

WindowsLinux
MalwareEnterprise

S0022: Uroburos

Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]

LinuxWindowsmacOS
MalwareEnterprise

S0125: Remsec

Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. [1]

Windows
MalwareEnterprise

S0247: NavRAT

NavRAT is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. [1]

Windows
MalwareEnterprise

S0251: Zebrocy

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. [1][2][3][4]

Windows
Relationship explorer

All related ATT&CK context

uses · MalwareS0126: ComRATEnterpriseuses · MalwareS0395: LightNeuronEnterpriseuses · MalwareS0137: CORESHELLEnterpriseuses · MalwareS0337: BadPatchEnterpriseuses · MalwareS0023: CHOPSTICKEnterpriseuses · GroupG0010: TurlaEnterpriseuses · MalwareS0022: UroburosEnterpriseuses · MalwareS0201: JPINEnterprisemitigates · MitigationM1037: Filter Network TrafficEnterpriseuses · MalwareS0125: RemsecEnterpriseuses · MalwareS0247: NavRATEnterpriseuses · GroupG0083: SilverTerrierEnterpriseuses · MalwareS0351: CannonEnterpriseuses · MalwareS0251: ZebrocyEnterpriseuses · MalwareS0138: OLDBAITEnterpriseuses · GroupG0050: APT32Enterprisemitigates · MitigationM1031: Network Intrusion PreventionEnterpriseuses · MalwareS0495: RDATEnterpriseuses · MalwareS1090: NightClubEnterpriseuses · GroupG0007: APT28Enterpriseuses · GroupG0094: KimsukyEnterpriseuses · MalwareS1173: PowerExchangeEnterprisedetects · Detection StrategyDET0135: Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3)Enterprisesubtechnique of · TechniqueT1071: Application Layer ProtocolEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
3ac41f8492bef709...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle3ac41f8492be…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  2. [2]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  3. [3]
    ESET LightNeuron May 2019

    Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.

    Open source URL
  4. [4]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  5. [5]
    Unit 42 BadPatch Oct 2017

    Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.

    Open source URL
  6. [6]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  7. [7]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  8. [8]
    Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.

    Open source URL
  9. [9]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  10. [10]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  11. [11]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  12. [12]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  13. [13]
    Threatpost Sauron

    Michael Mimoso. (2016, August 8). ProjectSauron APT On Par With Equation, Flame, Duqu. Retrieved January 10, 2024.

    Open source URL
  14. [14]
    Talos NavRAT May 2018

    Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.

    Open source URL
  15. [15]
    Unit42 SilverTerrier 2018

    Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.

    Open source URL
  16. [16]
    Unit42 Cannon Nov 2018

    Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.

    Open source URL
  17. [17]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  18. [18]
    ESET Zebrocy Nov 2018

    ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.

    Open source URL
  19. [19]
    Unit42 Sofacy Dec 2018

    Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.

    Open source URL
  20. [20]
    ESET Zebrocy May 2019

    ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.

    Open source URL
  21. [21]
    Cybereason Oceanlotus May 2017

    Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.

    Open source URL
  22. [22]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  23. [23]
    Unit42 RDAT July 2020

    Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.

    Open source URL
  24. [24]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  25. [25]
    Cybersecurity Advisory GRU Brute Force Campaign July 2021

    NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.

    Open source URL
  26. [26]
    CISA AA20-301A Kimsuky

    CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.

    Open source URL
  27. [27]
    Symantec Crambus OCT 2023

    Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.

    Open source URL
  28. [28]
    Sentinel One Contagious Interview ClickFix September 2025

    Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.

    Open source URL
  29. [29]
    Cofense Agent Tesla

    James Arndt. (2023, February 21). The Rise of Agent Tesla: Understanding the Notorious Keylogger. Retrieved January 10, 2024.

    Open source URL
  30. [30]
    Fortinet Agent Tesla June 2017

    Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.

    Open source URL
  31. [31]
    Bitdefender Agent Tesla April 2020

    Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.

    Open source URL
  32. [32]
    PWC Yellow Liderc 2023

    PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.

    Open source URL
  33. [33]
    Mandiant UNC3890 Aug 2022

    Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.

    Open source URL
  34. [34]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  35. [35]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  36. [36]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  37. [37]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  38. [38]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  39. [39]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  40. [40]
    mitre-attackT1071.003
    Open source URL
  41. [41]
    mitre-attackT1071.003
    Open source URL
  42. [42]
    mitre-attackT1071.003
    Open source URL
  43. [43]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  44. [44]
    ESET LightNeuron May 2019

    Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.

    Open source URL
  45. [45]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  46. [46]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  47. [47]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  48. [48]
    Unit 42 BadPatch Oct 2017

    Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.

    Open source URL
  49. [49]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  50. [50]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  51. [51]
    Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.

    Open source URL
  52. [52]
    Microsoft PLATINUM April 2016

    Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.

    Open source URL
  53. [53]
    Kaspersky ProjectSauron Full Report

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.

    Open source URL
  54. [54]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  55. [55]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  56. [56]
    Threatpost Sauron

    Michael Mimoso. (2016, August 8). ProjectSauron APT On Par With Equation, Flame, Duqu. Retrieved January 10, 2024.

    Open source URL
  57. [57]
    Talos NavRAT May 2018

    Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.

    Open source URL
  58. [58]
    Unit42 SilverTerrier 2018

    Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.

    Open source URL
  59. [59]
    Unit42 Cannon Nov 2018

    Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.

    Open source URL
  60. [60]
    ESET Zebrocy May 2019

    ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.

    Open source URL
  61. [61]
    ESET Zebrocy Nov 2018

    ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.

    Open source URL
  62. [62]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  63. [63]
    Unit42 Cannon Nov 2018

    Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.

    Open source URL
  64. [64]
    Unit42 Cannon Nov 2018

    Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.

    Open source URL
  65. [65]
    Unit42 Sofacy Dec 2018

    Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.

    Open source URL
  66. [66]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  67. [67]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  68. [68]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  69. [69]
    Cybereason Oceanlotus May 2017

    Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.

    Open source URL
  70. [70]
    Unit42 RDAT July 2020

    Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.

    Open source URL
  71. [71]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  72. [72]
    Cybersecurity Advisory GRU Brute Force Campaign July 2021

    NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.

    Open source URL
  73. [73]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  74. [74]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  75. [75]
    CISA AA20-301A Kimsuky

    CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.

    Open source URL
  76. [76]
    Symantec Crambus OCT 2023

    Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.

    Open source URL
  77. [77]
    Sentinel One Contagious Interview ClickFix September 2025

    Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.

    Open source URL
  78. [78]
    Bitdefender Agent Tesla April 2020

    Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.

    Open source URL
  79. [79]
    Cofense Agent Tesla

    James Arndt. (2023, February 21). The Rise of Agent Tesla: Understanding the Notorious Keylogger. Retrieved January 10, 2024.

    Open source URL
  80. [80]
    Fortinet Agent Tesla June 2017

    Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.

    Open source URL
  81. [81]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  82. [82]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  83. [83]
    PWC Yellow Liderc 2023

    PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use