It\u2019s going to be one of those days. Your CISO or head of IT looks worried and you\u2019re getting a familiar burning sensation in your stomach as he explains the situation. He\u2019s getting too technical – talking about \u201cEmotet\u201d, \u201cMealybug\u201d, and something called \u201cthe infamous Ryuk gang\u201d. You ask the question: \u201cWhat can we do?\u201d You mentally translate his answer into lost revenue and productivity. And an unpleasant conversation with your boss… <\/em><\/p>\n If your business connects in any way to the internet you are vulnerable to a nasty bit of malware called \u201cEmotet\u201d. This malware first appeared in 2014, the product of the hacker group \u201cMealybug\u201d. It hides in spam emails that appear to originate from trusted vendors like PayPal or DHL. If the user opens the email and attached Word or Excel document (sometimes labeled as an \u201cInvoice\u201d or \u201creceipt\u201d) and the user\u2019s system is connected to the internet, the embedded macro downloads additional code which harvests the machine\u2019s address book and initiates a new batch of spam emails to all the user\u2019s contacts, spreading the infection farther.<\/p>\n But that was just in Mealybug\u2019s <\/em>first generation of Emotet. After seven years the Mealybug<\/em> group now runs a full-service criminal operation providing its malware as a service (MaaS) to other criminal organizations, including the aforementioned Ryuk<\/em> gang, famous for their ransomware attacks on governments, academia, healthcare, manufacturing and technology companies\u2019 digital systems. By 2017, Emotet was also being used to distribute the Trickbot Trojan<\/em> that targeted US banking companies with bogus emails supposedly from a legitimate DropBox mailbox that lured the user to download a \u201csecure document\u201d containing various malware.<\/p>\n How expensive were these attacks? According to the alert sent in July 2018 by the U.S. Dept. of Homeland Security these EMOTET<\/a> infections have cost the infected governmental organizations up to $1 million per incident to resolve.<\/p>\n Your IT folks assured you that your antivirus network guardian programs were fully up-to-date. How did this malware evade detection?<\/p>\n Emotet is polymorphic code. It modifies itself as it self-installs on a machine so that no two versions of the malware look the same after installation. Signature-based antivirus software looks for specific chunks of code (akin to fingerprints), but the Emotet code looks different on every new machine.<\/p>\n There is some good news. The website Bleepingcomputer.com <\/em>reports that in January 2021 international law enforcement isolated and captured the hundreds of distributed cloud-based servers around the globe that were being used to support Emotet\u2019s functions. According to Europol, by April 25, 2021, the\u00a0 Emotet malware was finally uninstalled from all infected devices<\/a> using a module developed by the German Bundeskriminalamt (BKA) federal police agency.<\/p>\n Unfortunately, the shutdown of Emotet\u2019s infrastructure was temporary. The malware reappeared four months later and as recently as December 15, 2021, the Cryptolaemus Emotet group reported (on BleepingComputer.com<\/a>) that they were \u201c\u2026observing<\/em> Cobalt Strike<\/em><\/a> (CS) Beacons being dropped as of the last few minutes\u2026\u201d<\/em>. Those CS modules were being directly downloaded by Emotet from its C2 (Command and Control) server for execution on the infected devices. They quickly spread laterally across the infected endpoints, steal files, and deploy malware with immediate access to the compromised networks.<\/p>\n Bye-bye botnets\ud83d\udc4b Huge global operation brings down the world’s most dangerous malware.<\/p>\n Investigators have taken control of the Emotet botnet, the most resilient malware in the wild.<\/p>\n Get the full story: https:\/\/t.co\/NMrBqmhMIf<\/a> pic.twitter.com\/K28A6ixxuM<\/a><\/p>\n \u2014 Europol (@Europol) January 27, 2021<\/a><\/p><\/blockquote>\n\n