We have long anticipated this and advised customers to rigorously block unknown IMAP, POP and SMTP traffic as well. Now a rootkit that exploits precisely this security gap has been published on Github.
A brief code analysis shows that IMAP and SMTP over SSL are used to retrieve emails from a mailbox and receive BASE64-encoded messages, with file transfers also planned for the future.
The published code can currently:
- Establish a persistent foothold in the system. (As a Python mail client)
- Transfer files
- Change directories
- Retrieve system information
- Send arbitrary commands to the system and return their output.
Contact us at any time for help with hardening your systems. We can also support your migration to Exchange or Office365 to close off this entry point completely.