H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

IMAPLoader

[IMAPLoader](https://attack.mitre.org/software/S1152) is a .NET-based loader malware exclusively associated with [CURIUM](https://attack.mitre.org/groups/G1012) operations since at least 2022. [IMAPLoader](https://attack.mitre.org/software/S1152) leverages email protocols for command and control and payload delivery.(Citation: PWC Yellow Liderc 2023)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[IMAPLoader](https://attack.mitre.org/software/S1152) is a .NET-based loader malware exclusively associated with [CURIUM](https://attack.mitre.org/groups/G1012) operations since at least 2022. [IMAPLoader](https://attack.mitre.org/software/S1152) leverages email protocols for command and control and payload delivery.(Citation: PWC Yellow Liderc 2023)

Labels

malware
10 recorded

Relationships

uses
from CURIUM
Group
uses
to AppDomainManager
Technique
uses
to Create or Modify System Process
Technique
uses
to Hidden Window
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Mail Protocols
Technique
uses
to Native API
Technique
uses
to Scheduled Task
Technique
uses
to System Information Discovery
Technique
uses
to Windows Management Instrumentation
Technique
2 external

References

mitre-attack
S1152
open
PWC Yellow Liderc 2023
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance