Emotet Malware

guest · Oct 6, 2020

Emotet Malware
Alert (AA20-280A)
October 6, 2020
https://us-cert.cisa.gov/ncas/alerts/aa20-280a

Summary
This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.
This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC).
Click to expand...

Emotet—a sophisticated Trojan commonly functioning as a downloader or dropper of other malware—resurged in July 2020, after a dormant period that began in February. Since August, CISA and MS-ISAC have seen a significant increase in malicious cyber actors targeting state and local governments with Emotet phishing emails. This increase has rendered Emotet one of the most prevalent ongoing threats.

To secure against Emotet, CISA and MS-ISAC recommend implementing the mitigation measures described in this Alert, which include applying protocols that block suspicious attachments, using antivirus software, and blocking suspicious IPs.
Technical Details [...]
Click to expand...

guest · Oct 6, 2020

CISA: Emotet increasing attacks on US state, local governments
October 6, 2020
https://www.bleepingcomputer.com/ne...easing-attacks-on-us-state-local-governments/

Emotet attacks have targeted multiple state and local governments in the U.S. as part of potentially targeted campaigns that have been ramping up since August, the Cybersecurity and Infrastructure Security Agency (CISA) said in an alert published today.

Emotet, a common banking Trojan when it was first spotted in 2014, in recent years has evolved into a botnet that the TA542 threat group (also tracked as Mummy Spider) uses to deliver second stage malware payloads on infected devices.
The malware is used to drop other malware families including the Trickbot (a known vector used to deploy both Ryuk and Conti ransomware) and the QakBot trojans.
Click to expand...

US govt entities targeted by Emotet in August
Today's alert is based on information collected by both CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC) since Emotet's resurgence in July 2020.

During this time, "CISA observed Emotet being executed in phases during possible targeted campaigns," the DHS agency explains.
16,000 Emotet activity alerts since July
Starting with July 2020, CISA has observed increased Emotet activity, with the "EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks" detecting around 16,000 related alerts.

"Since reemerging on July 17, Emotet has sustained its activities with daily spam runs spewing more than 500K emails every day (except weekends) starting at around 2:00 AM Pacific Time (UTC -7)," Microsoft said at the time.
Click to expand...

guest · Dec 4, 2020

The chronicles of Emotet
December 4, 2020
https://securelist.com/the-chronicles-of-emotet/99660/

More than six years have passed since the banking Trojan Emotet was first detected. During this time it has repeatedly mutated, changed direction, acquired partners, picked up modules, and generally been the cause of high-profile incidents and multimillion-dollar losses. The malware is still in fine fettle, and remains one of the most potent cybersecurity threats out there. The Trojan is distributed through spam, which it sends itself, and can spread over local networks and download other malware.

All its “accomplishments” have been described thoroughly in various publications and reports from companies and independent researchers. This being the case, we decided to summarize and collect in one place everything that is currently known about Emotet.
Click to expand...

Log in or Sign up

Emotet Malware

guest Guest

guest Guest

guest Guest

Log in or Sign up

Emotet Malware

guest Guest

guest Guest

guest Guest

Useful Searches