GONEPOSTAL: New Outlook Backdoor by Russia’s APT28 Uses Email for C2

Kroll has identified a new espionage campaign attributed to Russia’s APT28 (Fancy Bear), involving a custom Outlook macro backdoor called GONEPOSTAL that uses a covert email-based command-and-control channel. The intrusion began with two DLLs, SSPICLI.dll and tmp7EC9.dll, with the malicious SSPICLI.dll pretending to be Microsoft’s legitimate DLL of the same name and forwarding its exported functions to the renamed DLL to allow the attack to appear normal.

Behind the scenes, the attacker’s code executes hidden PowerShell commands, including one that copies a staged file (testtemp.ini) into the Outlook profile directory as VbaProject[.]OTM to activate the backdoor, while other commands exfiltrate the victim’s username and IP address via DNS and HTTP queries to attacker-controlled infrastructure.

The malware then modifies Windows Registry keys to force Outlook to load malicious macros at startup, for example enabling macro loading and setting Outlook to “enable all macros” and suppressing dialog warnings. According to Kroll, this approach allows the email service itself to serve as the C2 channel, enabling the backdoor lifecycle from Outlook login to email monitoring and covert data exfiltration.