After a three-month hiatus, the Emotet malware operation resumed spamming malicious emails on Tuesday morning, rebuilding its network and infecting devices worldwide.
The Emotet botnet has resumed sending emails, according to the cybersecurity firm Cofense and the Emotet-tracking group Cryptolaemus. “Emotet malicious email activity resumed on Tuesday, March 7, 2023 at 8:00am EST,” according to the Cofense website.
The malicious emails include unprotected.zip files as attachments. While the attached.zip files deliver malicious macros in Office documents, which download and execute the Emotet.dll. However, it is unknown how long this round of email activity will last, as activity levels in 2022 varied greatly.
The .zip files attached to these recent Emotet emails contain an Office Document with macros. When the file is opened, the user is prompted to “Enable Content,” which allows the malicious macros to run. The macros will download an Emotet.dll from the internet and run it locally on the machine.
Emotet is a type of computer malware that was originally designed as a banking Trojan. The goal was to gain access to foreign devices and spy on sensitive personal information. Emotet has been known to deceive and hide from basic antivirus programs. When a computer is infected with malware, it spreads like a computer worm and attempts to infiltrate other computers on the network.
It primarily spreads via malspam, which is spam email containing malware (hence the term). To persuade users, these messages frequently use familiar branding, mimicking the email format of well-known and trusted companies such as PayPal or DHL. Once loaded, Emotet will sit quietly in the background, waiting for instructions from a remote command and control server.
Eventually, the malware will steal victims’ emails and contacts for future Emotet campaigns, or it will download additional payloads such as Cobalt Strike or other malware that frequently leads to ransomware attacks.
The sources for this piece include an article in BleepingComputer.
