Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TAG started actively tracking UAC-0098 after identifying an email phishing campaign delivering AnchorMail (referred to as “LackeyBuilder”) in late April 2022. AnchorMail is a version of the Anchor backdoor that uses the simple mail transfer protocol (SMTPS) for command and control (C2) communication.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
checkip.amazonaws.com ipecho.net/plain ipinfo.io/ip api.ipify.org icanhazip.com myexternalip.com/raw wtfismyip.com/text ip.anysrc.net/plain/clientip
AnchorMail is notable for communicating with its C2 server using SMTP and IMAP protocols over TLS, referred to as SMTPS and IMAPS respectively.
AnchorMail uses the encrypted SMTPS protocol for sending data to the C2, and IMAPS is used for receiving it.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A version of the Anchor backdoor that uses SMTPS for C2 communications; observed in phishing against Ukraine and assessed as a Conti-developed tool.
Backdoor malware that uses email protocols over TLS for command-and-control, sending specially crafted messages via SMTPS and retrieving responses via IMAPS. It decrypts embedded mail server credentials and configuration, encodes requests into email subjects and attachments, and parses returned messages for commands and parameters.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.