Emotet on the rise with heavy spam campaign

guest · Sep 24, 2018

Emotet on the rise with heavy spam campaign
September 21, 2018
https://blog.malwarebytes.com/cybercrime/2018/09/emotet-rise-heavy-spam-campaign/

The threat landscape is changing once again, now that the ocean of cryptocurrency miners has shrunk to a small lake. Over the last couple months, we’ve seen cybercriminals lean back on tried and true methods of financial theft and extortion, with the rise of a familiar Banking Trojan: Emotet.

However, over the last few days, we’ve noticed a large increase in malicious spam spreading Emotet, as well as a higher number of detections from our customers. Looks like we’re in the middle of an active Emotet campaign.

In addition to Emotet, this malspam campaign is also pushing Trickbot, a popular information-stealing malware that we spoke about last year when unused code was discovered using the same exploit as WannaCry.

This spam campaign is pushing malicious documents to users: first Microsoft Word documents with malicious macro scripts and then PDFs with built-in malicious scripts.
Click to expand...

guest · Nov 21, 2018

Emotet’s Thanksgiving Campaign Delivers New Recipes for Compromise
November 21, 2018
https://threatpost.com/emotets-thanksgiving-campaign-delivers-new-recipes-for-compromise/139280/

Looking to take advantage of a nation preparing for a collective food coma, the cybercriminals behind the campaign have so far sent out 27,000 or so messages daily, with verbiage that marks a departure from the standard financial themes regularly seen used as phishing lures by the group.

Forcepoint researchers found that the document is not the usual .doc or .docx typically seen in Emotet campaigns, but rather an XML file masquerading as a .doc. The macro in this instance makes use of the Shapes feature, ultimately leading to the calling of the shell function.
[...] The macro, too, has been recently evolved from the typical Emotet pattern, with upgraded macro obfuscation and formatting.

“The Emotet crew have quite thoughtfully included some cheerful Thanksgiving words in the emails,” said researchers from Forcepoint, in a posting Tuesday on the campaign. “In the few weeks since Emotet returned it has undergone some interesting changes, most notably in the new Thanksgiving theme and macro obfuscation.”
Click to expand...

guest · Dec 10, 2018

Quincy City Hall Infected with Emotet, Hacked Email Used in Phishing Scheme
The entire computing system shut down to after the attack
December 10, 2018
https://news.softpedia.com/news/qui...ed-email-used-in-phishing-scheme-524204.shtml

City's computing systems offline for five days
The people of the Massachusetts Norfolk County city were advised by a spokesperson from the mayor's office to be very careful when opening unsolicited email messages from @quincyma.gov addresses.

As initially reported by The Patriot Ledger, Chris Walker, a spokesperson for mayor's office stated that "Between Wednesday, Nov. 21 and Sunday, Nov. 25, the information technology department shut down all city servers and computers to clear out the virus. Emails and the city website were down for the holiday weekend."
Multiple Emotet malware campaigns active during the past few months
Although the Emotet banking trojan was removed from the City Hall's computing systems, the phishing campaign might still be active with some emails reaching the town's people.
Click to expand...

guest · Dec 24, 2018

Amazon Order Confirmation Phishing Scam
December 24, 2018
https://www.infosecurity-magazine.com/news/amazon-order-confirmation-phishing/

All those who have relied upon the e-commerce giant Amazon to order their holiday gifts should heed caution when receiving order confirmation emails, as EdgeWave reportedly discovered a new and highly sophisticated malspam campaign sending fake Amazon order confirmation messages.

According to BleepingComputer [...]
Unsuspecting users who click on the link thinking they are downloading a Word document named order_details.doc are then instructed to “Enable Content” [...] which reportedly downloads and executes the Emotet banking Trojan.

"Interestingly, these other servers are in Houston and Lansing. Playing Dora the Explorer for a moment, we’ve encountered a compromised email server in Columbia sending phishing email with a link to a server in Indonesia that downloads malware which then contacts compromised servers in the United States,” EdgeWave reportedly said.
Click to expand...

guest · Dec 28, 2018

Analysis of the latest Emotet propagation campaign
December 28, 2018
https://www.welivesecurity.com/2018/12/28/analysis-latest-emotet-propagation-campaign/

The propagation began with an email message, which had nothing particularly special about it. As seen in Figure 1, it was pretty much the kind of email we are used to seeing in these campaigns.

However, the trick used by the cybercriminals in this campaign has several unusual features. If you opt to look at the macro, you find that it is not very big and at first glance, it does not seem to be one of those known macros that try to connect to a website to download some content… or is it?
[...] Effectively, this text box contains a “cmd” command, which launches a PowerShell script that tries to connect to five sites and then download the payload, which in this case is an obfuscated variant of Emotet.

Though not at all a new technique, this small change in the way Emotet’s action is hidden within the Word file demonstrates how sneaky cybercriminals can be when it comes to concealing their malicious activity and trying to compromise user information.
Click to expand...

guest · Jan 16, 2019

Emotet re-emerges after the holidays
January 15, 2019
https://blog.talosintelligence.com/2019/01/return-of-emotet.html

This latest strain has also gained the ability to check if the infected IP where the malicious email is being sent from is already blacklisted on a spam list. This could allow attackers to deliver more emails to users' inboxes without any pushback from spam filters.

One unusual thing we have observed recently is the use of HTTP 301 redirects. The initial URL is requested with a connection keep-alive in the header. This initial HTTP request is met with a 301 pointing back to the same URL.
This second request results in the malware being delivered and the header no longer includes the keep-alive. The reason for the 301 redirection and second request are currently unknown since browsing directly to the URL results in the malware being returned.
CONCLUSION
As shown by the recent blacklist checking for the spamming module, Emotet is looking to maximize that financial gain whenever possible, and at the same time, minimize payloads that will have little return on investment. It's these types of changes that will continue to keep Emotet near the top of the crimeware landscape.
Click to expand...

guest · Jan 23, 2019

Going In-depth with Emotet: Multilayer Operating Mechanisms
January 23, 2019
https://blog.trendmicro.com/trendla...-with-emotet-multilayer-operating-mechanisms/

Multilayer Operating Mechanisms: Document Droppers and Packed Executables
The activities of Emotet’s artifacts — its document droppers and packed executable samples — showed discrepancies in terms of when each showed signs of activity. As we’ve mentioned in our previous blog entry, we observed that the infrastructure for creating and spreading document droppers differ from that of packing and deploying its executables.

We then portrayed the activity patterns of the document droppers and the packed executable samples. We saw that on some days, new documents surfaced but no executables appeared, or vice versa. This may mean that multilayer operating mechanisms for creating document droppers and producing executable samples exist. [...]

More Emotet mitigation techniques, as well as an extensive analysis of Emotet’s activities, operational models, infection chains, and binaries, can be found in our research titled “Exploring Emotet’s Activities.”
Click to expand...

Analysis: "Exploring Emotet’s Activities" https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf

guest · Jan 29, 2019

Emotet: A veritable Swiss Army knife of malicious capabilities
January 29, 2019
https://www.helpnetsecurity.com/2019/01/29/emotet/

Anton Wendel, Security Engineer at G DATA Advanced Analytics, says that Emotet has been developed very professionally for years and that there are days when up to 200 new variants are discovered.

Emotet’s creators eschew using exploit kits to deliver the malware. Instead, they are using the malware’s spam module to shoot out fake emails that will lead victims to it. As they have access to the address books on the system, they can try to recreate relationship networks so that the messages are tailored for the various targets.
“Emotet uses MAPI (Messaging Application Programming Interface) to do so,” G DATA researchers explained.

The infected attachment usually comes in the form of a Microsoft Word document with macros enabled, and the path of infection relies on the user.
Click to expand...

guest · Feb 14, 2019

mood said: ↑

Emotet’s Thanksgiving Campaign Delivers New Recipes for Compromise
November 21, 2018
https://threatpost.com/emotets-thanksgiving-campaign-delivers-new-recipes-for-compromise/139280/
Click to expand...

Similar attack (malicious XML files camouflaged as DOC documents):
Emotet Uses Camouflaged Malicious Macros to Avoid Antivirus Detection
February 14, 2019
https://www.bleepingcomputer.com/ne...alicious-macros-to-avoid-antivirus-detection/

A new Emotet Trojan variant has been observed in the wild with the added ability to hide from anti-malware software by embedding malicious macros used to drop the main payload inside XML files disguised as Word documents.
Hides in plain sight
Menlo Security detected a new variant of the Emotet Trojan active since mid-January, which obfuscates the initial infection VBA macro code to minimize anti-malware detection levels.
According to the researchers:

The first type, and the more prominent one, was an XML file that contains the standard XML header, plus the Microsoft Word Document XML format tags. This is followed by Base64 encoded data, which contains the compressed and obfuscated VBA macro code. The file itself was named with a .doc extension.
The infection procedure is quite complex and it follows a sequential structure, with the initial malicious script spawning multiple processes which will launch a Powershell script that downloads the Emotet payload to the TEMP folder on the compromised machine.
Click to expand...

guest · Apr 11, 2019

New Emotet trojan variant found targeting users in Chile using ‘Living off the Land’ technique
April 11, 2019
https://cyware.com/news/new-emotet-...-using-living-off-the-land-technique-eb9db37f

A new variant of Emotet trojan has been found collecting financial information of users by injecting malicious code into computers. The variant has affected a total of 176 users in Chile.
How does it spread - According to the researchers from SI-Lab, the attackers used phishing emails to spread the malware. The attackers had embedded the malicious code in a document or URL that was inserted within the body of the email. The document or URL were disguised as an invoice or PDF attachment to trick users.
How does it operate - The attack involved the use of an old ‘Living off the Land’ technique to evade antivirus detection and complicate its analysis.

“Interestingly, the first phase bypasses Virus Total (VT) detentions. With that, criminals achieved an important rule of thumb in the malware landscape: no detection. In fact, an old living off the land technique was used allowing to get fully undetectable (FUD) which is the ultimate goal for malware authors,” explained the SI-Lab researchers.
[...] The second script leverages the WinRAR vulnerability to drop the Emotet variant into the Windows startup folder.
Click to expand...

guest · Apr 16, 2019

Emotet Gang Distributes First Japanese Campaign
April 15, 2019
https://cofense.com/flash-update-emotet-gang-distributes-first-japanese-campaign/

Cofense Intelligence™ has identified yet another change in Emotet’s behavior, this time distributing a campaign targeting Japanese-speaking recipients. The messages, which reference potentially overdue invoices and the payments thereof, deliver a macro-laden document, as per Emotet’s modus operandi

Diversifying their target-base is the latest link in an ever-lengthening chain of updates and refinements being pushed by the actors behind Emotet. The targets in this campaign include Japanese academic institutions, demonstrating a keen interest in Emotet securing a presence in such networks worldwide.
Click to expand...

guest · Apr 25, 2019

Emotet Uses Compromised Devices as Proxy Command Servers
April 25, 2019
https://www.bleepingcomputer.com/ne...compromised-devices-as-proxy-command-servers/

A new Emotet Trojan variant has been observed in the wild with the added capabilities of using compromised connected devices as proxy command-and-control servers and of employing random URI directory paths to evade network-based detection rules.
Connected devices as an extra C2 communication layer
The researchers also found that Emotet's operators are actively attempting to compromise devices such as IP cameras, routers, webcams, and web interfaces/administration panels to add them to their camouflage infrastructure as part of their botnet's new extra server communication layer.

"These discoveries also show that the malware is being used to compromise and collect vulnerable connected devices, which could become resources for other malicious purposes," states Trend Micro.
Randomly generated URIs for a stealthiness boost
The Emotet payload was delivered onto the targets' computers using malicious emails which come with zipped up Powload Trojan attachments which will download the Emotet executable after being launched.

This new version sends the stolen info within the HTTP POST message body, "encrypted with an RSA key and AES, and encoded in Base 64" allowing it to "evade detection or delay further investigation if it is detected."
Click to expand...

Trend Micro: Emotet Adds New Evasion Technique and Uses Connected Devices as Proxy C&C Servers

guest · May 16, 2019

Threat Actor Profile: TA542, From Banker to Malware Distribution Service
May 15, 2019
https://www.proofpoint.com/us/threa...ile-ta542-banker-malware-distribution-service

Proofpoint researchers began tracking a prolific actor (referred to as TA542) in 2014 when reports first emerged about the appearance of the group’s signature payload, Emotet (aka Geodo)
More recently, we have observed Emotet delivering third-party payloads such as Qbot, The Trick, IcedID, and Gootkit. Additionally, Emotet loads its modules for spamming, credential stealing, email harvesting, and spreading on local networks.

TA542 typically distributes high volume email campaigns consisting of hundreds of thousands or even millions of messages targeting all industries. TA542 is currently one of the most prolific actors in the entire threat landscape. With TA542’s international reach and high volume campaign strategy, we expect Emotet use to continue to grow in the upcoming quarters.
As with many threat actors monitored by Proofpoint researchers, TA542 leverages social engineering mechanisms to increase infection rates.
Click to expand...

ZMsiXone · May 28, 2019

Emotet Botnet Behind Most Email-Based Threats in Q1 2019
May 28, 2019
https://www.bleepingcomputer.com/ne...t-behind-most-email-based-threats-in-q1-2019/

The multifunctional Emotet botnet malware was the most prevalent email-based threat in the first three months of the year, showing it is among the top choices for cybercriminals.
Telemetry data from ESET antivirus company indicates that Emotet has become the go-to botnet service to spread malware across the world, as it was the primary payload detected on protected computers.

Emotet started off as a banking malware and developed into a tool that can send out spam messages and distribute other threats on the systems it compromises.
Statistics gathered by ESET from the computers it protects in the first quarter of the year shows that 61% of malicious payloads delivered via email were botnets, all detected as Emotet.
Click to expand...

guest · Aug 5, 2019

The evolution of Emotet: How to protect your network
August 5, 2019
https://betanews.com/2019/08/05/emotet/

With over 350,000 new malware samples emerging every day, it’s difficult for any one strain of malware to make a name for itself. Any single malware sample whose name you know -- be it Mirai, WannaCry, or NotPetya -- speaks to a trail of devastation.
In 2019, people are also hearing another name: Emotet.

Think back to the last time you heard about Emotet in 2017
Then something changed -- something dramatic. Emotet’s creators kept adding modules and features, and its popularity grew.
Emotet routinely avoids these detection measures due to a feature known as polymorphism. It changes its own code while achieving the same functionality, so its hash value is different every time. It switches between IP addresses -- and its creators constantly register new IPs.

Although polymorphic malware is hard to detect, there are a few ways to reduce your risk
Click to expand...

Minimalist · Aug 23, 2019

Emotet Botnet Is Back, Servers Active Across the World

Command and control (C2) servers for the Emotet botnet appear to have resumed activity and deliver binaries once more. This comes after being inert since the beginning of June.

Although it started as a banking trojan in 2014, Emotet changed its course to becoming a botnet that delivers various malware strains.
Click to expand...

https://www.bleepingcomputer.com/ne...tnet-is-back-servers-active-across-the-world/

Minimalist · Aug 26, 2019

VB2019 preview: Exploring Emotet, an elaborate everyday enigma

Active since 2014, initially as a banking trojan, Emotet has been a plague on the Internet in recent years. Emotet's core strength is its ability to download other malware, thus giving those in control of it remote code execution on infected systems and networks. Emotet has been the initial infection in many high-profile attacks, in particular with ransomware such as Ryuk and MegaCortex.
Click to expand...

https://www.virusbulletin.com/blog/...w-exploring-emotet-elaborate-everyday-enigma/

guest · Sep 16, 2019

Activities from Emotet malware more than tripled in the past year in Singapore: Ensign InfoSecurity
September 16, 2019
https://www.straitstimes.com/tech/a...-tripled-in-the-past-year-in-singapore-ensign

A variant of a global malicious software, or malware, called Emotet tripled its activity level in Singapore in the last year and is posing a greater threat to local businesses and netizens, a local cyber security firm has warned.

Ensign InfoSecurity said in a release on Monday (Sept 16) that between Jan 1 and June 31 this year, it found that Emotet activities on the island had increased by more than 300 per cent compared to the same period last year.
It also found that one in two organisations had some form of Emotet-related activity in their network.

"Due to its modular and polymorphic composition, Emotet is almost invisible to conventional signature-based cybersecurity solutions," said Dr Lim.
Click to expand...

guest · Sep 16, 2019

Emotet Revived with Large Spam Campaigns Around the World
September 16, 2019
https://www.bleepingcomputer.com/ne...d-with-large-spam-campaigns-around-the-world/

Less than a month after reactivating its command and control (C2) servers, the Emotet botnet has come to like by spewing spam messages to countries around the globe.
Malicious emails with Emotet's signature have been spotted Monday morning targeting Germany, the United Kingdom, Poland, and Italy. The spam campaign also hit the USA, targeting both individuals, business, and government entities.
Emotet campaign by the numbers
Researchers noticed at the beginning of June that the C2 servers of Emotet had fallen silent and were no longer sending instructions to infected machines. The inactivity lasted until August 22, when the infrastructure starteded to wake up again and servers started to respond to requests.

Emotet started strong, with security researchers from email security corp Cofense Labs telling BleepingComputer that Emotet is now targeting almost 66,000 unique emails for more than 30,000 domain names from 385 unique top-level domains (TLDs).
Click to expand...

The fresh Emotet campaign observed starting this morning clearly shows that the botnet is once again ready for business. At 4 AM EST Cofense Labs tweeted that the botnet resumed its operations.
A few minutes later, SpamHaus Project, an organization tracking spam-related activity worldwide announced that Emotet was "fully back in action" and provided a sample email indicating a recipient in Poland.
Click to expand...

guest · Sep 19, 2019

Emotet Trojan Evolves Since Being Reawakend, Here is What We Know
September 19, 2019
https://www.bleepingcomputer.com/ne...s-since-being-reawakend-here-is-what-we-know/

With the reawakening of the Emotet botnet, the distribution methods, payloads, malicious document templates, and email templates continue to evolve. This article will go over some of the changes that have been observed by various security researchers over the past couple of days.
Click to expand...

guest · Sep 24, 2019

Emotet Tries to Infect You By Claiming It's Snowden's Book
September 24, 2019
https://www.bleepingcomputer.com/ne...-to-infect-you-by-claiming-its-snowdens-book/

Emotet has started a new spam campaign that pretends to be a scanned copy of Edward Snowden's new book. Unsuspecting users who open the attachment and enable its content will find that they have become infected with Emotet, most likely Trickbot, and possibly other malware.

As part of Emotet's continuing evolution, security researchers at Malwarebytes discovered a new spam campaign that takes an original approach by pretending to have an attached scanned copy of Edward Snowden's new book "Permanent Record". The researchers saw Snowden themed emails in English, Italian, German, French, and Spanish.
If the recipient opens the attachment, they will shown a message stating that "Word hasn't been activated" and that you need to click on Enable Editing or Enable Content to continue.

If the Enable Content button is clicked, a malicious macro will launch a PowerShell command that attempts to download Emotet from one of three embedded URLs.
When successful, the Trojan will quietly run in the background and download and install other malware on the computer.
Click to expand...

Malwarebytes: Emotet malspam campaign uses Snowden’s new book as lure

guest · Oct 1, 2019

Fake Office Activation Wizard Docs Used to Spread Emotet Trojan
October 1, 2019
https://www.bleepingcomputer.com/ne...ion-wizard-docs-used-to-spread-emotet-trojan/

The Emotet botnet has switched to a new template used by malicious attachments that pretend to be a Microsoft Office Activation Wizard.

When conducting spam campaigns, the actors behind Emotet will use malicious Word document templates that are designed to trick recipients into enabling macros in the document. Once these macros are enabled, a script will be executed that downloads and installs the Emotet Trojan and possibly other malware onto the recipient's computer.
Discovered by security researcher ps66uk, this new template prompts the victim to click on the Enable Editing and Enable Content buttons in order to complete the activation of Microsoft Office.

Ps66uk has told BleepingComputer that this is the first time the researcher has seen this particular document template being used by Emotet.
Once the user clicks the Enable Editing and Enable Content buttons, embedded macros will launch a PowerShell command that connects to a remote site, downloads the Emotet Trojan to the victim's %UserProfile%, and executes it.
Click to expand...

guest · Oct 31, 2019

Emotet Trojan Brings a Malware Scare with Halloween Emails
October 31, 2019
https://www.bleepingcomputer.com/ne...brings-a-malware-scare-with-halloween-emails/

The Emotet Trojan is celebrating Halloween by pushing out new spam templates that want to invite you to a neighborhood party. While these emails promise you a treat, in reality Emotet is tricking you into installing an infection.

We first heard about this new template from the Emotet tracking group, Cryptolaemus, and email security firm Cofense Labs, who was kind enough to send BleepingComputer some images of the new theme as shown below.
Each of these emails contain a word document that pretends to be the Halloween party invite.
If a user opens the attachment they will be greeted with the standard "Enable Content" button that when clicked will install the Emotet Trojan on the computer. So don't click it :)

So if you receive an email with a last minute invite to a Halloween party, do not open the attachment as, unlike Halloween candy, doing so will not be a pleasant experience.
Click to expand...

guest · Nov 6, 2019

Emotet resurgence packs in new binaries, Trickbot functions
One of the most dangerous modular malware variants is back with new delivery functions
November 6, 2019
https://www.zdnet.com/article/emotet-resurgence-packs-in-new-binaries-malicious-functions/

Emotet, a Banking Trojan turned devastating modular threat, has returned with upgraded functions in a new wave of attacks.
The malware, first discovered in 2014, has evolved over the past few years from a relatively basic, singular threat into a customizable modular package used to deploy additional payloads against financial institutions, the enterprise, and consumers worldwide.

On Wednesday, cybersecurity researchers from Netscout said that Emotet activity started to decline in May this year, but this hiatus was short-lived.
According to the team, Emotet has now begun sharing a number of obfuscation techniques already utilized by Trickbot. A new export function has also been found in executable binary functions -- used by both malware variants -- and this feature resolves API names through an export list of loaded DLLs. The API call resolution is present in both Emotet and Trickbot packers.

Since September, new Emotet binaries have appeared almost every day. Netscout says that each binary contains roughly 40 - 80 C2 indicators, with C2 distribution spread worldwide rather than being concentrated in particular areas.
Click to expand...

Netscout: Emotet - What's Changed?

guest · Nov 11, 2019

TrickBot Malware Uses Fake Sexual Harassment Complaints as Bait
November 11, 2019
https://www.bleepingcomputer.com/ne...es-fake-sexual-harassment-complaints-as-bait/

Fake sexual harassment complaints appearing to come from the U.S. Equal Employment Opportunity Commission are the latest baits used by attackers to disseminate TrickBot banking Trojan payloads onto computers of unsuspecting employees of large companies.
Spearphishing campaign dropping malicious payloads
As part of this campaign, the malware operators use information collected for each target such as their names, the company they work for, their job titles, and even their phone numbers to customize the phishing emails in order to make them a lot more convincing.
For instance, everything from the email's subject and the message content to the malicious attachment each of the malspam emails come with contains the potential victim's name as MalCrawler discovered.
By adding a "personal touch" to their phishing emails, the attackers greatly increase the chance of their TrickBot payloads being dropped and infecting their victims computers.

However, it's not all bad news. This campaign's operators fell into the same traps most phishers fall for starting with poor spelling (harrassment instead of harassment) and forms that don't match the rest of the messages' content and logos (a US Federal agency logo with a state of California form) being the most obvious signs of something not being quite right.
Click to expand...

Log in or Sign up

Emotet on the rise with heavy spam campaign

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ZMsiXone Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Emotet on the rise with heavy spam campaign

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ZMsiXone Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches