Emotet

Emotet is a malware strain and a cybercrime operation believed to be based in Ukraine.^[1] The malware, also known as Heodo, was first detected in 2014 and deemed one of the most prevalent threats of the decade.^[2][3][4] In 2021, the servers used for Emotet were disrupted through global police action in Germany and Ukraine and brought under the control of law enforcement.^[4]

First versions of the Emotet malware functioned as a banking trojan aimed at stealing banking credentials from infected hosts. Throughout 2016 and 2017, Emotet operators, sometimes known as Mealybug, updated the trojan and reconfigured it to work primarily as a "loader," a type of malware that gains access to a system, and then allows its operators to download additional payloads.^[5] Second-stage payloads can be any type of executable code, from Emotet's own modules to malware developed by other cybercrime gangs.

Initial infection of target systems often proceeds through a macro virus in an email attachment. The infected email is a legitimate-appearing reply to an earlier message that was sent by the victim.^[6]

It has been widely documented that the Emotet authors have used the malware to create a botnet of infected computers to which they sell access in an Infrastructure-as-a-Service (IaaS) model, referred in the cybersecurity community as MaaS (Malware-as-a-Service), Cybercrime-as-a-Service (CaaS), or Crimeware.^[7] Emotet is known for renting access to infected computers to ransomware operations, such as the Ryuk gang.^[8]

As of September 2019, the Emotet operation ran on top of three separate botnets called Epoch 1, Epoch 2, and Epoch 3.^[9]

In July 2020, Emotet campaigns were detected globally, infecting its victims with TrickBot and Qbot, which are used to steal banking credentials and spread inside networks. Some of the malspam campaigns contained malicious documents with names such as "form.doc" or "invoice.doc". According to security researchers, the malicious document launches a PowerShell script to pull the Emotet payload from malicious websites and infected machines.^[10]

In November 2020, Emotet used parked domains to distribute payloads.^[11]

In January 2021, international action coordinated by Europol and Eurojust allowed investigators to take control of and disrupt the Emotet infrastructure.^[12] The reported action was accompanied with arrests made in Ukraine.^[13]

On 14 November 2021, new Emotet samples emerged that were very similar to the previous bot code, but with a different encryption scheme that used elliptic curve cryptography for command and control communications.^[14] The new Emotet infections were delivered via TrickBot, to computers that were previously infected with TrickBot, and soon began sending malicious spam email messages with macro-laden Microsoft Word and Excel files as payloads.^[15]

On 3 November 2022, new samples of Emotet emerged attached as a part of XLS files attached within email messages.^{[16][self-published source]}

Distribution Method:

• Emotet is typically spread via malicious email attachments or links, often disguised as invoices, payment notifications, or other business-related documents.
• It leverages techniques like social engineering to trick victims into opening the email and enabling macros in the document, which then installs the malware.

Modular Structure:

• Emotet acts as a delivery vehicle for other malware, often used in multi-stage attacks.
• After infecting a machine, Emotet can download additional payloads, including trojans, ransomware, or data stealers.

Propagation Mechanisms:

• Emotet has worm-like capabilities, allowing it to spread within a network by brute-forcing credentials or exploiting vulnerabilities.
• Once inside a network, it can compromise multiple machines, significantly increasing the damage potential.

Resilience and Evasion:

• It uses obfuscation techniques and regular updates to avoid detection by traditional antivirus software.
• Emotet also employs Command and Control (C2) infrastructure, allowing attackers to remotely control infected systems and update the malware.

Impact and Damage:

• The presence of Emotet can lead to financial theft, data breaches, ransomware infections, and disruption of IT systems, particularly in businesses and governmental organizations.^[17]

According to MITRE's ATT&CK Framework, Emotet employs a variety of techniques across different stages of an attack. These techniques are part of the MITRE ATT&CK matrix, which helps categorize the tactics used by malware to achieve various objectives such as initial access, persistence, and lateral movement.^[18]

• Allentown, Pennsylvania, city located in Pennsylvania, United States (2018)^[19][20]
• Heise Online, publishing house based in Hanover, Germany (2019)^[6]
• Kammergericht Berlin, the highest court of the state of Berlin, Germany (2019)^[21][22]
• Humboldt University of Berlin, university in Berlin, Germany (2019)^[23]
• Universität Gießen, university in Germany (2019)^[24]
• Department of Justice of the province of Quebec (2020)^[25]
• Lithuanian government (2020)^[26]