Skip to content
Threat Feed

Actor

BadPatch

1 brief RSS
low threat

Suspicious SMTP Activity on Port 26/TCP

This rule detects SMTP traffic on TCP port 26, an alternative to the standard port 25 that the BadPatch malware family has used for command and control of Windows systems.

BadPatch command-and-control exfiltration network-traffic
2r 3t