ESET Research has published a summary of what happened with the Emotet botnet since its comeback after a limited takedown.
Emotet is a malware family active since 2014, operated by a cybercrime group known as Mealybug or TA542. Although it started as a banking trojan, it later evolved into a botnet that became one of the most prevalent threats worldwide.
In January 2021, Emotet was the target of a limited takedown as a result of an international, collaborative effort of eight countries, coordinated by Eurojust and Europol.
Emotet came back to life in November 2021 and launched multiple spam campaigns with an abrupt end in April 2023. In its latest 2022-2023 campaigns, most of the attacks detected by ESET were aimed at Japan (almost half of them), Italy, Spain, Mexico and South Africa.
"Emotet spreads via spam emails. It can exfiltrate information from, and deliver third-party malware to, compromised computers. Emotets operators are not very picky about their targets, installing their malware on systems belonging to individuals as well as companies and bigger organizations," says ESET researcher Jakub Kalo who worked on the analysis.
Throughout late 2021 and until mid-2022, Emotet was spreading mainly via malicious MS Word and MS Excel documents with embedded VBA macros. In July 2022, Microsoft changed the game for all the malware families like Emotet and Qbot which had used phishing emails with malicious documents as its method of distribution by disabling VBA macros in documents obtained from the Internet.
"The disabling (by authorities) of Emotet's main attack vector made its operators look for new ways to compromise their targets. Mealybug started experimenting with malicious LNK and XLL files," says Kalo.
"However, by the time 2022 was ending, Emotet's operators struggled to find a new attack vector that would be as effective as VBA macros.
"In 2023, they ran three distinctive malspam campaigns, each testing a slightly different intrusion avenue and social engineering technique," says Kalo.
"However, the shrinking size of the attacks and constant changes in the approach may suggest dissatisfaction with the outcomes."
Later Emotet embedded a lure into MS OneNote and despite warnings that this action might lead to malicious content, people tended to click on it.
After its reappearance, received got multiple upgrades. The notable features were that the botnet switched its cryptographic scheme and implemented multiple new obfuscations to protect their modules. Emotet's operators have invested significant effort to avoid monitoring and tracking of their botnet since they returned. Additionally, they implemented multiple new modules and improved existing modules to remain profitable.
Emotet is spread via spam emails, and people often trust those emails, because it successfully uses an email thread hijacking technique. Before the takedown, Emotet used modules we call Outlook Contact Stealer and Outlook Email Stealer, that were capable of stealing emails and contact information from Outlook.
However, because not everyone uses Outlook, post-takedown Emotet also focused on a free alternative email application Thunderbird. Additionally, it started to use Google Chrome Credit Card Steale moduler, which steals information about credit cards stored in the Google Chrome browser.
According to ESET research and telemetry, Emotet botnets have been quiet since the beginning of April 2023, most probably due to finding of a new effective attack vector. Most of the attacks detected by ESET since January 2022 until today were aimed at Japan (43%), Italy (13%), Spain (5%), Mexico (5%) and South Africa (4%).