CHT Security Delivered Speech at DEF CON Sinpapore 2026

Turning Spam Filters Into Your Greatest Enemy: Intrusions Via RCEs in E-Mail Spam Filters

Ting-Wei Hsieh CHT Security Co., Ltd.

Kai-Ching Wang CHT Security Co., Ltd.

In the last couple of years, APTs targeting critical organizations in Taiwan have exploited multiple 0-day and N-day vulnerabilities in popular local email server software. Advertised as advanced defenses that stop APT attacks, such filters are supposed to check the contents and attachments of all inbound emails and block potential threats. In contrast to the claims, those spam filters became the very entry point of several high-profile intrusions, leading to zero-interaction compromises of high-value targets. From command injection to digital cluster bombs combining automated shellcode injection and a kernel module backdoor, attackers were able to get full control of a target system with just a single crafted email.

In this session, I will share cases of real-world APT intrusions via exploiting vulnerabilities in email server software from different vendors, along with sophisticated malware used in the attacks. I will also share our recommendations to mitigate such risks for vendors alike. Our findings suggest that nation-state actors have already gained a comprehensive understanding of the inner workings of popular email server software in target regions, marking the importance of security awareness in the development of such public-facing software.

Ting-Wei Hsieh

Ting-Wei is a malware analyst at CHT Security Co., Ltd, working primarily in the incident response team that constantly deals with APT attacks and novel malware. As a self-taught reverse engineer, Ting-Wei is interested in Windows static and dynamic malware analysis, x64 obfuscation, packing and evasion techniques.

Kai-Ching Wang

Kai-Ching Wang (Keniver) is a Senior Security Researcher at CHT Security. He specializes in red team assessments and comprehensive security reviews, with a current focus on hacking IoT devices and cloud-native infrastructure. He has presented his research on the security of cloud-connected IoT camera systems at conferences such as SECCON in Japan and HITCON in Taiwan.

For details please click here.