Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:30 PM
Connect Directly

New Attack Campaigns Suggest Emotet Threat Is Far From Over

Malware described by the DHS as among the worst ever continues to evolve and grow, researchers from Cisco Talos, Cofense, and Check Point Software say.

In a troubling development for organizations, security researchers are reporting a recent resurgence in activity related to Emotet — malware that the US Department of Homeland Security (DHS) has previously described as among the most destructive ever.

Cisco Talos on Thursday reported seeing increased Emotet activity targeting US military domains and domains belonging to state and federal governments.

According to the vendor, the operators of Emotet appear to have successfully compromised accounts of one or more people working for or with the US government and sent out spam emails containing the malware to their contacts. The result was a rapid increase in the volume of messages containing Emotet directed at .mil and .gov top-level domains last month and and so far this month, the vendor said.

Researchers at Cofense, meanwhile, reported on another Emotet campaign, this one targeted at some 600 staffers at the United Nations. The campaign involved an email purporting to be from the Permanent Mission of Norway with an attachment that, if opened, would eventually result in Emotet being downloaded on the system.

Jason Meurer, senior research engineer at Cofense, says there has been at least two previous compromises of a permanent mission to the United Nations related to Emotet, which may have been used to gather contact lists and emails. "We saw a few other subject lines that appear to have been scraped from stolen emails, likely indicating more victims leading up to this most recent campaign," he says.

In late December, Check Point Software described its incident response team as seeing hundreds of Emotet attacks per day, including one on the city of Frankfurt that forced officials to take its network offline to prevent further damage. According to the company, it responded to some 34 attacks last year where Emotet had been used to infect a network with Ryuk ransomware. Every single Ryuk ransomware incident that Check Point investigated in 2019, in fact, involved Emotet, Check Point said.

Ripple Effects
Emotet emerged in 2014 as a banking Trojan, but over the years has morphed into one of the most sophisticated and widely used tools for distributing malware. Its operators are known for infecting systems widely and then selling access to those systems to other threat actors, most notably those behind the Trickbot banking Trojan and the Ryuk ransomware family.

Emotet spreads mainly via spam email — often customized to appear more convincing to targeted victims. The malware is typically concealed in PDF documents, malicious links, or rogue Word documents. Typical lures to get users to click on the attachments and links have included names suggesting PayPal receipts, shipping notifications, invoices for payments, and legal documents. The recent campaign targeting UN staffers involved an attachment that purported to be some kind of a signed agreement involving the Norwegian government.  

Once Emotet infects a system, it steals names and email addresses from victims' contact lists and uses them to send phishing emails to other victims. It can also steal passwords and comes integrated with features for detecting sandboxes and other security-control mechanisms. Emotet campaigns have hit organizations around the world, but among the most heavily targeted are those based in North America, the UK, and Australia.

"Getting infected with Emotet has many different ripple effects," says Craig Williams, director of outreach at Cisco Talos. "Infected systems are used to transmit Emotet to additional victims, sensitive information such as email data can be exfiltrated, and the infection gives attackers the ability to move laterally within networks where Emotet is present."

What makes Emotet especially troubling is the way it uses social engineering and personal and professional relationships to spread, Cisco Talos said in its report on the recent attacks against .mil and .gov targets. Because Emotet uses a victim's contact list to send itself to other people, a person receiving the email can be lured into believing it is safe. Sometimes the message that Emotet sends includes the contents of a previous email exchange between the victim and the recipient, further adding to its apparent authenticity, Cisco Talos said.

Remediating Emotet infections can be challenging because of how adept the malware is at spreading inside a network — from a single machine to hundreds, Williams says. "Additionally, it has been used in some large-scale ransomware campaigns that have resulted in large amounts of data loss and destruction," he says.

Security researchers and others have been especially worried about Emotet's use in distributing other malware and in providing access to infected networks. Back in June 2018, the DHS's Cybersecurity and Infrastructure Security Agency (CISA) had described Emotet as "among the most costly and destructive malware" targeting government, public, and private-sector organizations. According to CISA, each Emotet infection has cost state, local, and federal government entities up to $1 million to remediate.

CISA has warned about the polymorphic nature of the malware and its ability to continuously evolve and update its functions, as well as its ability to evade typical signature-based detection systems and to maintain persistence on an infected system.

Since the 2018 CISA alert, security researchers have said the malware and methods used to distribute it have only become more devious and dangerous.

"Emotet has established itself as a king amongst malware distributors, capable of delivering infections to a large number of infected hosts," Check Point said in a report released this week. "It is also able to act as a launching platform for precise and coordinated attacks against well-financed organizations."  

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Comprehend the Buzz About Honeypots."


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/17/2020 | 5:27:49 AM
Truly scary that this threat is still not over...
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-17
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built...
PUBLISHED: 2020-02-17
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbi...
PUBLISHED: 2020-02-17
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. ...
PUBLISHED: 2020-02-17
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. Due to improper processing of some data, a local authent...
PUBLISHED: 2020-02-17
Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Att...