Summary

Ten months after its massive takedown in January of 2021, Emotet is back and seeking resurgence. This malware, which first appeared in 2014 as a banking trojan, attempts to infect computers and steal sensitive information. It spreads through spam emails (Malspam) via infected attachments and embedded malicious URLs. In some of its spam campaigns, the emails commonly have a financial theme and appear to come as a reply to a previous transaction by using fake payment remittance notices, invoice attachments, or payment details.

Fast forward to November 2021, the Trickbot banking trojan was observed to download and execute updated Emotet binaries to computers previously infected with Trickbot with macro-laden Microsoft Excel, Microsoft Word, and a password-protected ZIP archive containing a Word document as payloads, marking the resurgence of the highly known sophisticated threat.

Emotet evolved multiple times over the years since 2014, and turned its operations into a successful crimeware rink. It provides Malware-as-a-Service (MaaS) to other malware groups to rent access to the Emotet-infected computers to infect them with other malware such as TRICKBOT, QBOT, and RYUK Ransomware. For this reason, it has been known to be one of the most professional and most potent cyberthreats in history.