Loading threat actor…
QuietEnvelope is a malware toolset associated with a likely Chinese advanced persistent threat operation. It was developed to target the MailGates email protection system used with OpenFind email servers. Reported tradecraft includes the use of Perl scripts and multiple stealth-oriented backdoors, including a loadable kernel module backdoor designed to provide covert command execution. Simplified Chinese debug strings have been observed in the malware, supporting assessment of a Mainland China nexus, although a specific cluster or publicly established subgroup attribution is not available. QuietEnvelope appears tailored for post-compromise access against email security infrastructure, indicating an emphasis on covert persistence, command execution, and follow-on exploitation of enterprise messaging environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
QuietEnvelope is a sophisticated toolset targeting OpenFind mail servers, using multiple stealthy backdoors and Perl scripts to maintain remote access. The toolset is believed to be the work of an unknown state-sponsored threat actor, with evidence suggesting a Chinese-speaking origin.
QuietEnvelope is a malware strain developed to target OpenFind MailGates email servers, likely by a Chinese APT.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.