Badpatch - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/badpatch/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 07:05:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of Potential Command and Control via SMTP on Port 26/TCPhttps://feed.craftedsignal.io/briefs/2026-08-smtp-port-26-c2/Mon, 31 Aug 2026 07:05:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-smtp-port-26-c2/Adversaries, including the BadPatch malware family, utilize non-standard port 26/TCP for SMTP-based command and control and data exfiltration to evade traditional security monitoring.This brief outlines the risk posed by adversaries, such as the operators of the BadPatch malware, who repurpose TCP port 26 for command and control (C2) and exfiltration activities. While port 25 is the standard for Simple Mail Transfer Protocol (SMTP), port 26 is frequently leveraged to bypass traditional security controls that primarily scrutinize port 25 traffic. By initiating outbound SMTP communication from internal hosts to external destinations on port 26, attackers maintain persistent C2 channels that blend in with legitimate traffic if not explicitly monitored. Defensive teams must focus on identifying this non-standard outbound traffic to detect potential infections and unauthorized data movement within their environments.

Attack Chain

  1. Initial compromise occurs on a target host (e.g., via phishing or exploit).
  2. The malware identifies the need for external communication to a C2 server.
  3. The malware checks network configuration or hardcoded settings to use port 26/TCP.
  4. The host initiates a TCP connection to an external, attacker-controlled IP address over port 26.
  5. The malware encapsulates C2 instructions or exfiltrated data within the SMTP protocol format.
  6. The connection is maintained to receive subsequent tasking or data upload commands.

Impact

Success of this attack allows attackers to establish persistent, stealthy control over internal Windows systems. Impact includes the risk of sensitive data exfiltration and the potential for further malware deployment or lateral movement within the network. The scope of targeting is primarily enterprise organizations where standard port monitoring may be insufficient.

Recommendation

Prioritize the identification of baseline network traffic to eliminate known legitimate services before alerting.

  • Deploy the provided detection logic to network monitoring sensors to alert on outbound traffic on port 26/TCP.
  • Enable network flow or firewall logging for outbound connections originating from internal subnets.
  • Establish a baseline for authorized internal mail relays that communicate with external SMTP destinations to reduce false positives in the SIEM.
  • Isolate systems identified in alerts and perform incident response procedures, focusing on memory and file system analysis for the BadPatch malware.
]]>lowadvisorycommand-and-controlexfiltrationnetwork-trafficsmtpbadpatch