{
  "family": "dapato",
  "sample_count": 197,
  "category": "trojan_generic",
  "description": "Trojan:Win32/Dapato is a persistent trojan historically associated with massive spam botnets, designed to quietly commandeer endpoint resources to distribute millions of unsolicited pharmaceutical or malicious emails.<br><br><b>What is Dapato?</b><br>For the end-user, a Dapato infection might only be noticeable due to degraded network performance. For network administrators, Dapato represents a significant reputational risk. If an endpoint is infected with Dapato, it is actively participating in a global spam botnet, which will quickly result in the organization's public IP addresses being blacklisted by global anti-spam organizations (like Spamhaus).<br><br><b>Infection Vectors & Threat Hunting</b><br>Dapato is typically distributed via exploit kits or as a secondary payload dropped by other trojans. Upon execution, it drops a randomized executable into the Windows directory and establishes persistence via the Registry Run keys. Dapato frequently injects its spamming engine into legitimate system processes (like <code>svchost.exe</code> or <code>explorer.exe</code>). It communicates with its C2 server to receive templates for the spam emails and lists of target email addresses. It then utilizes its own built-in SMTP engine to bypass local email clients and fire the spam directly out to the internet.<br><br><b>Forensic Analysis & Impact</b><br>Threat hunters will observe a massive, continuous spike in outbound traffic on TCP port 25 (SMTP) originating from unexpected processes. EDR platforms frequently detect Dapato based on 'Suspicious SMTP Activity' or 'Process Injection'. The impact is network congestion, IP blacklisting, and potential legal or compliance issues due to the unauthorized distribution of spam.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1498",
    "T1566",
    "T1547.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound spam traffic and prevent further IP blacklisting.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Utilize EDR to identify and terminate the specific injected process running the Dapato SMTP engine.",
    "Monitor the organization's public IP reputation on services like MXToolbox to ensure you have not been blacklisted during the infection."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; being blacklisted will cause all legitimate corporate emails to be blocked globally.",
    "Avoid assuming the threat is contained just by stopping the spam; the initial vector that dropped Dapato must be identified."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}