Very sobering, but ultimately, it seems the same vectors, ie: clicking on a bad link or document and not having the requisite security software/settings in place. It's not going to be universal because security, vigilance and caution are a drag to many and this is the prey these things feast on. I run a crappy browser but use a sandbox to conduct all online financials, deleting its contents afterward--it's second nature. Using a comprehensive anti-exploit with an anti-keylogger and updated anti malware. No need to pile it on, just invest some time and maybe a little money into the right combo and use your noggin.
Exactly, and there are plenty of ways to block it even after it has been executed, like block it from running explorer.exe, block code injection, and block the registry modification part. Most malware isn't really that advanced.
EMOTET Trojan Variant Evades Malware Analysis http://www.securityweek.com/emotet-trojan-variant-evades-malware-analysis
OK so perhaps this malware is a bit more advanced than I thought, but eventually it will have to perform certain malicious behavior that should be caught via HIPS.
