Emotet on the rise with heavy spam campaign

guest · Nov 28, 2019

Beware of Thanksgiving eCard Emails Distributing Malware
November 26, 2019
https://www.bleepingcomputer.com/ne...anksgiving-ecard-emails-distributing-malware/

With Thanksgiving being celebrated in the United States, malware distributors are sending out holiday themed emails to distribute the Emotet Trojan and other malware.

One of the malicious email campaigns discovered by BleepingComputer pretends to be a "Thanksgiving Day Greeting Card" with a Word document attachment named "Thanksgiving-eCard.doc".
Malicious Word docs lead to Trojans
For either of these malspam campaigns, if a user opens the malicious Word document they will be presented with a screen stating that they need to "Enable Content" or "Enable Editing" in order to properly view it.
These Word documents contain obfuscated macros that will either download malware from a remote host or extract it from an embedded payload.

Finally, if a Word document asks you to Enable Content or Enable Editing, this should always be a source of concern and users should not do so unless it is confirmed the email is legitimate.
Click to expand...

guest · Dec 2, 2019

Emotet’s Central Position in the Malware Ecosystem
December 2, 2019
https://news.sophos.com/en-us/2019/12/02/emotets-central-position-in-the-malware-ecosystem/

As the world rolls into another Cyber Monday, and online shoppers continue their hunt for the best deals, SophosLabs wants to remind you that there’s a metaphorical malware elephant in the room that would like nothing more than to steal financial information, and the use of your computer, for nefarious ends.

The Emotet Ecosystem infographic, produced by experts within SophosLabs, describes the infection process and subsequent behavior commonly displayed by samples in the Emotet malware family. Emotet is routinely among the most problematic and widely distributed malware family that Sophos researchers encounter daily. If there were such a thing as a Most Wanted list for malware, Emotet would surely top the list.
Click to expand...

Part of the payload package may, in fact, be components that assist Emotet in finding and infecting other victims. In this way, Emotet plays a uniquely central role in a wide variety of malware infection scenarios, just a few of which are illustrated here.

Most Emotet infections begin with a malicious spam email that prompts the recipient to open a malicious Microsoft Office document.
After establishing persistence (the ability to start itself after a reboot), the malware sends profile information to its operator(s) about the victim and their computer.

Depending on what the profile information reveals about the target, and the goals or priorities of the attacker, the attacker may leverage the payloads that Emotet distributed to deliver ransomware or other malware payloads.
Click to expand...

guest · Dec 16, 2019

Emotet Trojan is Inviting You To A Malicious Christmas Party
December 16, 2019
https://www.bleepingcomputer.com/ne...-inviting-you-to-a-malicious-christmas-party/

Just in time for the holidays, the Emotet Trojan gang has started to send Christmas themed emails that they hope will entice you to open their attachments and become infected. They even want you to wear your ugliest Christmas sweater!
This is typically done using a variety of email themes such as payment invoices, payment receipts, shipping details, voicemails, and eFaxes.
Emotet wants to invite you to a party
In a new spam campaign first noted by email security company Cofense Labs, Emotet has started to send out spam emails that impersonate a Christmas party invite using subjects like "Christmas Party next week" or "Christmas party".

Attached to these emails are malicious Word documents with names like 'Christmas party.doc', and 'Party menu.doc'.
According to Microsoft, who also saw this new Christmas campaign, when a user opens the attachment it will say that the recipient must click on 'Enable Editing' or 'Enable Content' in order to view it.
When a user enables the content, though, embedded macros will be executed that install the Emotet Trojan in Windows.
Click to expand...

guest · Dec 18, 2019

Attackers Posing as German Authorities Distribute Emotet Malware
December 18, 2019
https://www.bleepingcomputer.com/ne...german-authorities-distribute-emotet-malware/

An active malspam campaign is distributing Emotet banking Trojan payloads via emails camouflaged to look like messages delivered by several German federal authorities warns the BSI, Germany's federal cybersecurity agency.

The attackers behind this malicious campaign have already successfully infected a number of federal administration authorities during the last few days according to reports cited by the BSI (also known as the Federal Office for Security in Information Technology — Bundesamt für Sicherheit in der Informationstechnik).

"Spam emails with malicious attachments or links are currently being sent on behalf of several federal agencies," the BSI says.
Emotet malspam sent as replies in previous conversations
Besides these already confirmed Emotet infections, the BSI also suspects that there are more victims. The agency is also actively working with all concerned German authorities to address this threat.
"These are primary infections that lead to further spam emails being sent on behalf of those affected," the BSI adds.
Click to expand...

guest · Dec 19, 2019

Emotet Gang Changes Tactics Ahead of the Winter Holidays
December 19, 2019
https://www.bleepingcomputer.com/ne...changes-tactics-ahead-of-the-winter-holidays/

With the end of the year approaching fast, the authors of Emotet have made some changes that may increase their revenue for the holidays.
One of the modifications refers to the URI structure clients use to check into the command and control servers. Another change is the malware delivery method.

In the latest campaigns, Emotet returned to the old habit that proved to be an efficient delivery method. The researchers say that using link-based templates again is probably an attempt to maximize victim count ahead of the winter holidays.
The current campaigns take advantage of the holiday season and send out emails pretending to be from shipping companies, a theme not at all unusual this time of the year.

Another lure noticed by the researchers is an email template that uses the "Open Enrollment 2020," targeting users that still have to choose a health insurance program for 2020.
Click to expand...

As for the payload, TrickBot remains the main malware in recent campaigns. The researchers say they observed "heavy distribution," which could indicate one last effort to make money before the winter break.
Click to expand...

Cofense: Emotet Modifies Command & Control URI Structure and Brings Back Link-based Emails

guest · Dec 19, 2019

Emotet Malware Uses Greta Thunberg Demonstration Invites as Lure
December 19, 2019
https://www.bleepingcomputer.com/ne...greta-thunberg-demonstration-invites-as-lure/

Emotet has started a new spam campaign that is banking off the popularity of environmental activist Greta Thunberg and her dedication to the climate movement. Unsuspecting users who think they are getting info about an upcoming "climate crisis" demonstration, will instead find that they have become infected with Emotet and other malware.

This new campaign was discovered by ExecuteMalware and pretends to be an invite to a new climate change demonstration by Greta Thunberg and uses email subjects such as "Demonstration 2019" or "I invite you" to entice you into opening the email. The spam even recommends that you forward the email on to your friends and family.
Attached to these emails is a malicious Word document attachment called "Support Greta Thunberg.doc". If a user opens this document they will be met with a prompt to click on the "Enable editing" and then "Enable content" buttons to see the demonstration information.

If the Enable Content button is clicked, a malicious macro will launch a PowerShell command that downloads the Emotet Trojan and executes it.
Click to expand...

guest · Jan 13, 2020

Emotet Malware Restarts Spam Attacks After Holiday Break
January 13, 2020
https://www.bleepingcomputer.com/ne...re-restarts-spam-attacks-after-holiday-break/

After almost a three-week holiday vacation, the Emotet trojan is back and targeting the over eighty countries with malicious spam campaigns.

Emotet expert Joseph Roosen told BleepingComputer that on December 21st, 2019, Emotet stopped sending spam campaigns even though their command and control servers continued to run and issue updates.
At around 8:30 AM EST today, Roosen told us that Emotet began spewing forth spam campaigns again that target recipients around the world, with a strong focus on the United States.
Emotet is back from the holidays
Current Emotet campaigns being seen today include regular emails and reply-chain attacks pretending to be proof-of-delivery documents, reports, agreements, and statements.
Email security firm Cofense told BleepingComputer that they have seen spam campaigns targeting 82 countries, with a heavy targeting against the United States.
Click to expand...

guest · Jan 14, 2020

United Nations Targeted With Emotet Malware Phishing Attack
January 14, 2020
https://www.bleepingcomputer.com/ne...targeted-with-emotet-malware-phishing-attack/

Pretending to be the Permanent Mission of Norway, the Emotet operators performed a targeted phishing attack against email addresses associated with users at the United Nations.

While Emotet's normal spam campaigns pretended to be fake accounting reports, delivery notices, and invoices, the malware operators had something special in mind for the United Nations.
Impersonating the "Permanent Mission of Norway"
In a sample of a phishing email shared with BleepingComputer by email security firm Cofense, the Emotet operators pretend to be representatives of Norway at the United Nations in New York, who state that there is a problem with an attached signed agreement.

According to Cofense, this phishing campaign had "highly specific targeting" and was seen being sent to 600 unique email addresses at the United Nations.
Click to expand...

guest · Jan 16, 2020

Emotet Locked onto US Military and Government
January 16, 2020
https://www.infosecurity-magazine.com/news/emotet-locked-onto-us-military-and/

New research into the latest victims of Emotet has found increased instances of the malware affecting the United States of America's government and military.

Researchers made the discovery by closely examining the patterns of outbound email associated with the malware.
A Talos spokesperson said: "If a person has substantial email ties to a particular organization, when they become infected with Emotet the effects would manifest in the form of increased outbound Emotet email directed at that organization.

"One of the most vivid illustrations of this effect can be seen in Emotet's relationship to the .mil (U.S. military) and .gov (U.S./state government) top-level domains (TLDs).
The malware's successful compromise of at least one US government employee led to what researchers described as a "rapid increase" in the number of infectious Emotet messages directed at the .mil and .gov TLDs in December 2019.
Click to expand...

Cisco Talos: Stolen emails reflect Emotet's organic growth

guest · Jan 17, 2020

mood said: ↑

Emotet Malware Restarts Spam Attacks After Holiday Break
January 13, 2020
Click to expand...

Emotet Returns After Holiday Break with Major Campaigns
January 16, 2020
https://www.proofpoint.com/us/corporate-blog/post/emotet-returns-after-holiday-break-major-campaigns

Threat actor group TA542, the group that’s behind Emotet, is back from their Christmas holiday. Based on past activity and what we’re seeing in just three days, one of the world’s most disruptive threats is back to work and everyone around the world should take note and implement steps to protect themselves.

To understand how serious the potential threat of Emotet’s latest return can be, it’s helpful to look at the last break they took: May 2019 until late September 2019. Even though Emotet was on vacation for all but the last two weeks of Q3 (July – September), it still accounted for over 11% of all malicious payloads we saw for that entire quarter. hat statistic alone tells the story of what TA542 is capable of with Emotet.

On Monday, we saw Emotet get back to work with a new campaign. In this campaign Proofpoint observed TA542 pursuing potential victims in the western hemisphere (U.S., Canada, and Mexico) in the pharmaceutical industry in particular.
Click to expand...

On Monday alone we saw nearly three quarters of a million messages and they’re already fast approaching one million messages total. To give this context, this isn’t the highest volume we’ve ever seen from this actor: that was over one million messages in one day. But Monday was the biggest volume since April 2019.
Click to expand...

guest · Jan 20, 2020

Emotet Malware Dabbles in Extortion With New Spam Template
January 20, 2020
https://www.bleepingcomputer.com/ne...-dabbles-in-extortion-with-new-spam-template/

The goal of all of these emails is to trick the recipient into opening an attached Word document that will attempt to download and install the Emotet malware onto the computer.
Emotet starts impersonating extortion emails
In a new template shared with BleepingComputer by security researcher ExecuteMalware, the Emotet operators have started to use a similar extortion template that states "YOUR COMPUTER HACKED!" and that the recipient's data was stolen.
According to Emotet expert Joseph Roosen, this campaign first started around January 15th, 2020.

Due to the severity of the Emotet infection, users need to be wary of any strange emails they receive, especially ones containing Word attachments.
Click to expand...

guest · Jan 22, 2020

Increase in Emotet Spam Observed, Blocked by Symantec
As Emotet activity increased, Symantec blocked as many as 1 million Emotet spam emails per day
January 20, 2020
https://www.symantec.com/blogs/threat-intelligence/increase-emotet-spam-observed-blocked-symantec

At the end of 2018, it appeared that the Emotet group had gone dark when its malware campaigns greatly reduced in size. There was another major decline in the summer months of 2019; however, in September 2019, there was an increase in activity (over 100 percent) with Emotet’s (Trojan.Emotet) command and control (C&C) servers delivering a new wave of malicious binaries.

The types of emails being used in these attacks come in various forms. The first is an email with a link to an Office document file that contains a malicious macro, which then downloads the malicious executable payload.
Emotet uses social engineering techniques in its spam campaigns, tricking users into opening the file and running the macro to infect victims’ computers.
Click to expand...

guest · Jan 29, 2020

Emotet Uses Coronavirus Scare to Infect Japanese Targets
January 29, 2020
https://www.bleepingcomputer.com/ne...coronavirus-scare-to-infect-japanese-targets/

A malspam campaign is actively distributing Emotet payloads via emails that warn the targets of coronavirus infection reports in various prefectures from Japan, including Gifu, Osaka, and Tottori.

To scare the potential victims into opening malicious attachments, the spam emails — camouflaged as official notifications from disability welfare service provider and public health centers — promise to provide more details on preventative measures against coronavirus infections within the attachments.
Japanese coronavirus lures
According to reports from the infosec community, this campaign is using stolen emails from previously compromised accounts as a template to attempt and infect recipients with Emotet.
However, others point out that "Japanese in the subject and file names is strange" and that this "looks more sophisticated than other Emotet distribution attempts."

The end goal of such spam emails is to trick their recipient into opening an attached Word document designed to attempt to download and install the Emotet malware.
Click to expand...

guest · Feb 4, 2020

Emotet Gets Ready for Tax Season With Malicious W-9 Forms
February 4, 2020
https://www.bleepingcomputer.com/ne...eady-for-tax-season-with-malicious-w-9-forms/

The Emotet Trojan is getting ready for the tax season with a fresh spam campaign pretending to be signed W-9 tax forms.

With 2019 behind us, accounting departments are starting to issue tax forms needed for preparing the 2019 tax returns. As part of this process, companies request a signed W-9 form from their clients, independent contractors, and other people they do business.
This new Emotet spam campaign captures this feeling perfectly by using brief emails with a simple "Please see attached" and a fake W-9.doc attachment.

"While this tax season is just getting started, with many tax filing forms due to taxpayers last week, by Jan 31st, we anticipate these campaigns will likely evolve and get better as we move towards the annual filing date of April 15th," Cofense states in their report.
Click to expand...

Cofense: Emotet Gears Up to File (Your) Taxes

As with any other trend we’ve seen from this threat actor, the email messages are not sophisticated – in fact, these are quite basic.
Click to expand...

guest · Feb 6, 2020

This latest phishing scam is spreading fake invoices loaded with malware
February 6, 2020
https://www.zdnet.com/article/this-...-spreading-fake-invoices-loaded-with-malware/

Emotet activity appeared to decline during December, but it sprung back to life in January and it currently shows no signs of slowing down as researchers at Menlo Security have detailed yet another campaign.

This time, the attacks have been directed at organisations in financial services, with small numbers also targeted at the food, media and transportation industries. Three quarters of the attacks have been directed towards organisations in the US or in the UK, with the remaining hacking attempts directed towards the Philippines, Spain and India.
This time, the email subject lines are based around invoices, bank details and other financial subjects – common terms to attract the attention of workers in the financial sector.

The campaign spiked towards the end of January and while activity has dropped for now, financial institutions are still being targeted with Emotet phishing campaigns.

"We are continuing to see Emotet traffic, though the intensity has reduced considerably," Krishnan Subramanian, researcher at Menlo Labs told ZDNet.
Click to expand...

Menlo Security: Emotet attacks— a spike to start the year...

The initial attack is used only to gain a foothold in the network and establish contact with the command-and-control server. Once in place, additional malware is downloaded and the malware attempts to spread to other computers on the same network.
Conclusion
The Emotet malware has built a formidable infrastructure over time and can be destructive to an organization if not mitigated in a timely manner. Its techniques of leveraging multistage attacks and distributing malicious code through legitimate websites make the Emotet malware particularly hard to prevent with traditional security products that rely on signatures or threat intelligence.
Click to expand...

Minimalist · Feb 7, 2020

Emotet Hacks Nearby Wi-Fi Networks to Spread to New Victims

A recently spotted Emotet Trojan sample features a Wi-Fi worm module that allows the malware to spread to new victims connected to nearby insecure wireless networks according to researchers at Binary Defense.
Click to expand...

https://www.bleepingcomputer.com/ne...arby-wi-fi-networks-to-spread-to-new-victims/

guest · Feb 21, 2020

Emotet Malware Rears Its Ugly Head Again
February 21, 2020
https://www.itprotoday.com/data-security-and-encryption/emotet-malware-rears-its-ugly-head-again

As malware goes, Emotet has a surprisingly long history. Emotet malware first gained traction in 2014 as a Trojan that was designed to steal online banking information. Over time, Emotet evolved both in the way that it is delivered and in how it behaves.

Today, Emotet malware infections are primarily spread through malicious email messages propagated by botnets. These emails may claim to contain a payment invoice, a receipt for a recently purchased product, a shipping update or practically anything else that might entice an unsuspecting victim into opening an infected attachment.
At one time, it seemed as though Emotet was about to go extinct. However, Emotet has recently seen a resurgence--one big enough that it is reasonable to expect that Emotet will be one of the most pervasive security threats of 2020.

To put this another way, the third quarter of 2019 was approximately 13 weeks in length. This means that Emotet was active for only 15.4% of the quarter, but produced 11% of the total malicious payloads.
Click to expand...

There are a few reasons why Emotet malware is still rearing its ugly head. The biggest is that the Emotet trojan that is circulating today is not the same trojan that was being circulated in 2014. There have been several different iterations of Emotet, and it is therefore possible that signature-based detection tools can’t recognize the latest variants.
Click to expand...

guest · Feb 26, 2020

Mimecast: New Threat Intelligence Report Reveals the Rise of Emotet
February 25, 2020
https://www.mimecast.com/blog/2020/02/threat-intelligence-rsa-conference-edition/

The Mimecast Threat Center launched the Threat Intelligence Report: RSA Conference Edition today, finding a 145% increase in attack campaigns across the globe from October to December.
Researchers believe the increase can be attributed to Emotet’s renewed activity after four months of relative dormancy, coupled with cybercriminals’ higher rates of activity due to the holiday shopping season. From October to December 2019, the Mimecast Threat Center analyzed more than 202 billion emails and rejected 92 billion.
The Rise of Emotet
The most striking observation of the quarter’s research has been the widespread deployment of the Emotet “dropper” malware on a scale not seen before, across all regions
Click to expand...

Press Release: New Mimecast Threat Intelligence Report Analyzes 92 Billion Rejected Emails

Additional key findings outlined in the report:

The transportation, storage and delivery and retail and wholesale sectors were disproportionately attacked this past quarter due to the holiday season.

Emotet has been utilized far more extensively and has been seen in widespread campaigns against all sectors of the global economy. This discovery demonstrates a level of sophistication that goes beyond an opportunistic cybercriminal. In addition, due to the variety of businesses attacked, it’s highly likely the attacks continue to be carried out by highly organized criminal groups for monetary gain.

File compression continued to be an attack format of choice, but Emotet activity via DOC and DOCX formats substantially increased.

Relying on human error for success, bulk emailing remained a significant, high volume means to distribute malware. This trend will continue as it’s a powerful threat vector that can be deployed in huge volumes, increasing the possibility of success for threat actors.

Click to expand...

guest · Feb 29, 2020

Cryptolaemus group
Meet the white-hat group fighting Emotet, the world's most dangerous malware
February 29, 2020
https://www.zdnet.com/article/meet-...ing-emotet-the-worlds-most-dangerous-malware/

For more than a year, a group of security researchers and system administrators have banded together to fight back against Emotet, today's most active and dangerous malware operation.

By working together, the Cryptolaemus group has seriously hindered Emotet operations. Daily, the group publishes updates on its website and Twitter account. They share so-called indicators of compromise (IOCs). These include IP addresses for Emotet command servers, subject lines used in Emotet spam campaigns, and file hashes for Emotet-infected files.

"Personally, I just want to help people and stop this treat," said Joseph Roosen, one of the Cryptolaemus members.
"When Emotet infected my network at my day job in November of 2017, it was only stopped by us having a rather robust VLAN scheme, and therefore lateral movement was isolated and easier to clean up," Roosen said.
Click to expand...

Basically, Emotet shifted its entire mode of operation in only two years, from a closed group that stole money from people's bank accounts, into an open group that allowed other malware gangs to rent access to infected computers all over the world.
Nowadays, Emotet is one of the biggest "loader" operations on the market. It's effectively a cybercrime empire. They're so big that other "loaders" -- like TrickBot -- rent access to its huge network of infected computers.

Today, all good security researchers will tell you that Emotet is one of the most dangerous infections you can get, right next to TrickBot, another similar banking-trojan-turned-downloader operation.
Click to expand...

GETTING TOGETHER TO FIGHT EMOTET
It was in June 2018 when the idea of an anti-Emotet group came to be. In a Twitter group chat, a US-based system administrator named JayTHL asked "Any interest in a dedicated Emotet working group?"
Almost all in the chat said yes.
Now, the Cryptolaemus team lists over 20 members on its website, but their ranks are far larger. Many can't disclose their affiliation with the group due to non-disclosure agreements they've signed.
Click to expand...

guest · Mar 6, 2020

Minimalist said: ↑

Emotet Hacks Nearby Wi-Fi Networks to Spread to New Victims

https://www.bleepingcomputer.com/ne...arby-wi-fi-networks-to-spread-to-new-victims/
Click to expand...

Emotet Actively Using Upgraded WiFi Spreader to Infect Victims
March 6, 2020
https://www.bleepingcomputer.com/ne...ing-upgraded-wifi-spreader-to-infect-victims/

Emotet’s authors have upgraded the malware's Wi-Fi spreader by making it a fully-fledged module and adding new functionality as shown by samples recently spotted in the wild.
We previously reported that Emotet is now capable of spreading to new victims connected to nearby insecure wireless networks using a Wi-Fi worm module.

A researcher found evidence of Emotet Wi-Fi spreader being used to spread throughout one of his client's networks as Binary Defense threat researcher and Cryptolaemus contributor James Quinn told BleepingComputer.
New Emotet Wi-Fi spreader functionality
Besides its conversion from a stand-alone to a malware module, the Emotet developers also updated it with more verbose debugging and made changes that, in theory, could allow the Wi-Fi spreader to deliver other payloads besides the loader — which was the only known payload deliverer by the previous spreader version.
Click to expand...

Binary Defense: Emotet Wi-Fi Spreader Upgraded

guest · Apr 23, 2020

Emotet banking trojan possibly being prepped for a new attack
April 23, 2020
https://www.scmagazine.com/home/sec...ojan-possibly-being-prepped-for-a-new-attack/

Security researchers are seeing signs that the Emotet banking trojan is about to awaken from its latest hiatus by deploying newly improved credential and email stealing modules.

Emotet last came to life in January 2020 but analysts with the Herjavec Group believe the new modules are being placed as a first step toward the launch of a new phishing campaign. If and when this is released targets will find themselves battling its anti-malware evasion and a hashbusting implementation which makes it more dangerous compared to previous versions.
Hashbusting ensures that the malware will have a different hash on each system it infects, rendering hash-based detections useless.

Some of the technical changes incorporated include reworked malware code to incorporate the use of a state machine to obfuscate the control flow and branches of code being flattened into nested loops, which enables the code blocks to be in any order and operationally execute in order by the state machine.
Click to expand...

Herjavec Group: Threat Advisory Update: Emotet Botnet Shows Signs of Life & COVID-19 Phishing Campaigns Target Healthcare

guest · Jul 17, 2020

Emotet spam trojan surges back to life after 5 months of silence
July 17, 2020
https://www.bleepingcomputer.com/ne...urges-back-to-life-after-5-months-of-silence/

After months of inactivity, the notorious Emotet spamming trojan has come alive again as it spews out a massive campaign of malicious emails targeting users worldwide.

Binary Defense researcher James Quinn told BleepingComputer that Emotet was last seen on Feb 7th, 2020, after which the spamming trojan went quiet and has not sent out any spam emails since.
While the Emotet tracking group Cryptolaemus has been tracking the infection and has seen its malicious modules being updated over time, there has been no spamming conducted by the botnet other than some small tests earlier this week.
Emotet surges back to life
Today, Emotet suddenly surged back to life with reply-chain, shipping, payment, and invoice spam that deliver malicious Word documents spreadsheets.
Click to expand...

Roosen stated that the Emotet botnet is now spewing forth massive amounts of spam, and the malicious documents are using new URLs that are commonly hacked WordPress sites.
One of the Emotet spam emails shared with BleepingComputer by Binary Defense is a reply-chain template that pretends to be a shipping document from Loomis-express.com.
Click to expand...

#Emotet Update - @spamhaus / @nazywam Alerted us to a run of malspam coming form Emotet in the last 15-30 minutes. This is correct and we have confirmed this to be from the E2 botnet. Spam modules are being deployed and there is at least a test run being done currently. More Soon.
— Cryptolaemus (@Cryptolaemus1) July 17, 2020
Click to expand...

guest · Jul 21, 2020

Emotet botnet is now heavily spreading QakBot malware
July 21, 2020
https://www.bleepingcomputer.com/ne...tnet-is-now-heavily-spreading-qakbot-malware/

Researchers tracking Emotet botnet noticed that the malware started to push QakBot banking trojan at an unusually high rate, replacing the longtime TrickBot payload.
Full distribution
A group of researchers and system administrators united under the name Cryptolaemus to fight Emotet operations, saw today that the threat actor replaced TrickBot distribution across all epochs.
An Emotet epoch is a subgroup of the botnet running on a distinct infrastructure. Currently, there are three of them, each with separate command and control servers, distribution methods, and payloads.

Speaking to BleepingComputer, Cryptolaemus said that they saw QakBot distributed all across Emotet botnet, TrickBot being completely absent.
Click to expand...

However, speculating on a fallout between Emotet and TrickBot is premature as the relation between the operators of these treats two is not exclusive. Cryptolaemus said that a change in the delivered payload has happened in the past and that the original duo is very likely to resume activity.
But this does not occur too often, though. For instance, Emotet was seen delivering QakBot last year.
Click to expand...

guest · Jul 24, 2020

Emotet malware operation hacked to show memes to victims
July 24, 2020
https://www.bleepingcomputer.com/ne...re-operation-hacked-to-show-memes-to-victims/

Someone is poking fun at the Emotet botnet and heavily disrupting its operations by hacking into the malware's distribution sites and replacing malicious payloads with memes and GIFs.
LoLs for payloads
Emotet’s distribution relies on hacked websites where the actors store payloads to be used in their spam campaigns.

Joseph Roosen, a member of the Cryptolaemus group of researchers fighting Emotet, called the person messing with Emotet’s payloads a “white knight.”
The malicious documents and the malware from the botnet’s distribution sites were replaced with various images and memes.

“There is an ongoing battle for the control of the Emotet shells that drop maldocs/malware on T1 Distro sites. Someone is altering them to serve up Imgur gifs instead of malware,“ Roosen tweeted
Click to expand...

How does Emotehack happen
In short, bad opsec. Emotet operators use web shells to maintain access to the hacked websites in their distribution network. The most plausible explanation is that someone discovered the password and decided to use this advantage to disrupt Emotet operations.
Click to expand...

guest · Jul 28, 2020

Emotet malware now steals your email attachments to attack contacts
July 28, 2020
https://www.bleepingcomputer.com/ne...ls-your-email-attachments-to-attack-contacts/

The Emotet malware botnet is now also using stolen attachments to increase the authenticity of spam emails used for infecting targets' systems.

This is the first time the botnet is using stolen attachments to add credibility to emails as Binary Defense threat researcher James Quinn told BleepingComputer. The attachment stealer module code was added around June 13th according to Marcus 'MalwareTech' Hutchins.

"Emotet seems to be using not only stolen email bodies, but is now including stolen attachments as well," email security firm Cofense said today.
"This lends to even more authenticity in their phishing emails. In one example we found 5 benign attachments and a dropper link within the templated portion of the email."
Click to expand...

Log in or Sign up

Emotet on the rise with heavy spam campaign

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Emotet on the rise with heavy spam campaign

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches