Emotet Malware Gets More Aggressive

Emotets operators have been adding new capabilities, making the malware now even more dangerous to its enterprise targets.

Emotet, a nasty botnet and popular

malware family, has proven increasingly dangerous over the past year as its operators adopt new tactics. Now armed with the ability to drop additional payloads and arriving via business email compromise (BEC), its become a major threat to organizations.
Security watchers are wary of
Emotet
, which was among the first botnets to spread banking Trojans laterally within target organizations, making removal difficult. Emotet first appeared in 2014 as a Trojan designed to snatch banking credentials and other sensitive data. The threat was frequently spread via phishing emails packed with malicious documents or links.
Over time, Emotets operators - a group called Mealybug - have evolved its business model and the shape of their attack from a banking Trojan to a means of delivering other groups threats. In 2018, Webroot dubbed Emotet the years worst botnet seen distributing banking Trojans.
Its information stealing payloads are delivered at an impressive pace, suggesting threat actors have automated multiple steps in their campaign operations, Webroot researchers write in a
blog post
on their rankings of 2018s worst threats. The changes to Emotet, while gradual at first, quickly ramped up in recent years as attackers switched to even more nefarious tactics.
After a quiet period in 2015, Emotet detections spiked in the second half of 2017, Symantec
reported
. Mealybugs victims expanded that year to include targets in Canada, China, Mexico, and the UK. Toward the end of 2017, the Cylance Threat Research Team
analyzed
a malicious Microsoft Word file with a malicious macro program created to download Emotet malware.
Taking on New Threats
In 2018, Mealybug ramped up its activity to the point where it was selling malware to other actors, says Sig Murphy, managing director of incident response and forensics at Cylance. Emotet was combined with Trickbot and Qakbot, a tactic Symantec also had detected in Feb. 2018. The blend of Emotet with other strains of ransomware made the threat more dangerous.
The combination there is really hard to defend against properly because the loader is polymorphic, says Murphy. It changes every time it infects a computer.
US-CERT issued an
alert
for Emotet in July 2018, calling it an advanced modular banking Trojan that mainly functions as a downloader or dropper of other banking Trojans. Emotet is the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors, it says, costing governments up to $1M per incident.
This hybrid threat model is a unique challenge to organizations, Murphy says, and catches many off guard. Emotet alone used to drop its own Emotet-branded malware. Later in the year, it was used to deliver new types of threats. Before, it would collect email credentials and use them to spread laterally. It later became interested in the content of targeted emails, he adds.
Its pretty clear theyre trying to pivot into [the] BEC attack model, which is different from what theyve done in the past, says Murphy of the Mealybug threat groups evolving strategies. In August 2018, Trend Micro pick up on Spoofed banking emails
arriving
with Emotet malware. For example, spam emails contain payment notifications from spoofed bank email addresses. The emails body has a link to download a .doc file, which contains macros that, when run, activate a PowerShell command that downloads and runs the Emotet malware, researchers explain.
After ramping up in early 2018, Murphy says Emotet increased again during the holiday season. Through the start of 2019, the malware continued to spread, and new enterprise clients were asking Cylance for help after getting infected, he says. Its growth signifies greater maturity among the Mealybug actors as they learn whats effective.
They seem much more organized than a lot of other groups, Murphy explains. The shift [to BEC] says theyre continuing to be more organized … they know whats working and whats not. New ransomware variants like Qakbot provide a new source of income, he adds.
Thinking Ahead of the Attackers
Its hard to tell what Mealybug will do next. One route they could take, says Murphy, is attempt to make their attacks quieter. While he has no indication they might do this, he points out how Emotet in its current form is very noisy in its spread. If they could change the threat so it spreads without taking down systems, it would be harder to know a business is at risk.
Related Content:
6 CISO Resolutions for 2019
7 Business Metrics Security Pros Need to Know
Taming the Digital Wild West
Cyberattack Halts Publication for US Newspapers

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Emotet Malware Gets More Aggressive