Skip to content

Mail Protocols

Subtechnique · ATTACK:enterprise:T1071.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1071.003",
  "title": "Mail Protocols",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1071/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b",
  "external_id": "T1071.003",
  "domain": "enterprise",
  "created": "2020-03-15T16:21:45.131Z",
  "modified": "2026-09-03T19:46:40.083Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "FireEye APT28",
      "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    }
  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b2b0719-c82e-4d1f-b34c-7ed5dd5c8968

ESET ComRAT May 2020

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12918fb6-9b92-4644-a4c2-4f2f471e9b2c

ESET LightNeuron May 2019

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17049a4f-810d-4928-a0a0-84d4a732ca08

Microsoft SIR Vol 19 · FireEye APT28

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3126e151-051a-45ba-bc52-ca6f0f646fbb

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31462755-d050-4875-9d0b-0a7eeb276326

ESET Sednit Part 2

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3632ab1c-caa3-4d65-a665-7da325f4b7ac

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ce884c7-71c5-4f46-b09c-1abb45d8341b

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dd8150f-e20d-4ed0-a12e-c94641d1ba64

Microsoft PLATINUM April 2016

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7668ba-bde1-412c-b22d-65b57baabd0d

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--560a7947-3823-4f2b-8b84-238f9a9a2552

Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis · Threatpost Sauron · Symantec Remsec IOCs

ATTACK:enterprise:S0247 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d1d94e9-c0fd-421f-867f-1a426b0dff99

Talos NavRAT May 2018

ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e7e3226-1583-48de-9376-946fa88b6d15

Unit42 SilverTerrier 2018

ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62391d2c-56de-42e3-a937-fb9ffa3a4308

Unit42 Cannon Nov 2018

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68a91212-caee-45f3-ba09-95ed43f80af6

ESET Zebrocy May 2019 · ESET Zebrocy Nov 2018 · Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018 · Palo Alto Sofacy 06-2018

ATTACK:enterprise:S0138 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e2a0844-3618-41a7-b45d-12ad690f60a1

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76ec3407-84df-4bc9-8679-09564ca9329e

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78b31fa7-10ef-4c28-888e-71da978e9e81

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--804fb819-6b91-4295-aec9-b9299fb3472b

Unit42 RDAT July 2020

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--887ca054-848e-4a94-b299-2b625cb739df

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1fe7df1-7c20-422e-8e86-042cd11b3501

FireEye APT28 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a573685b-3135-44ae-9f9a-844dfc5bdaa2

CISA AA20-301A Kimsuky

ATTACK:enterprise:S1173 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac296623-0c14-4cb3-b2ce-2fc4a54c64e2

Symantec Crambus OCT 2023

ATTACK:enterprise:T1071.003 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b849b1ae-0b73-484c-9061-38ddf3cbdbb3

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba639658-3ca7-4694-aa05-056a6c1c4757

Sentinel One Contagious Interview ClickFix September 2025

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5401268-6b27-4088-9f2e-5439f68685d9

Bitdefender Agent Tesla April 2020 · Cofense Agent Tesla · Fortinet Agent Tesla June 2017

ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c81124ac-5df7-4443-9760-95208d19e599

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S1152 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c901aabc-e6ac-416a-89aa-a93f0a7349c7

PWC Yellow Liderc 2023

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db937076-3d30-471f-ad39-9565d61b614f

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2828065-a45c-40ef-86ad-d13c05f648d5

ESET Turla Lunar toolset May 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.