GONEPOSTAL Malware Exploits Outlook for Stealthy Command-and-Control

GONEPOSTAL is described as a sophisticated espionage campaign that turns Microsoft Outlook into a covert command-and-control channel, representing a notable evolution in living-off-the-land techniques. According to Kroll, the operation uses a two-stage attack to establish a persistent backdoor via email communications, beginning with a malicious dropper DLL masquerading as SSPICLI.dll that forwards 105 exported library functions to a renamed DLL, tmp7EC9.dll.

The dropper then triggers a PowerShell sequence that copies a file named testtemp.ini to the Outlook profile directory as VbaProject[.]OTM and implements redundant victim-identification mechanisms using DNS lookups and HTTP requests to webhook[.]site and oast[.]fun.

The malware also performs registry modifications to Outlook, enabling automatic macro loading, unrestricted macro execution, and suppression of security warnings via a PONT_STRING key, with the core functionality residing in a password-protected VbaProject[.]OTM containing obfuscated macros that transform Outlook into a backdoor, monitored by Outlook startup and NewMailEx events for four command types: cmd, cmdNo, upload and download.

GONEPOSTAL exfiltrates data by base64-encoding files, chunking them into about 3.15‑megabyte segments for attachment-based transfer, before cleaning up processed emails; attribution points to the Russian state-sponsored group KTA007, better known as Fancy Bear or APT28.