Emotet first appeared in 2014 as banking malware that attempted to infect computers and steal sensitive information. This malware mostly spreads by spam and phishing emails via infected attachments and embedded malicious URLs. It has worm-like capabilities to spread to other connected computers. It also collects the victim’s contact list and sends itself to the email addresses in the contact list.

In the latest malspam campaign, the emails commonly have a financial theme and appear to come as a reply to a previous transaction by using fake payment remittance notices, invoice attachments or payment details. It now utilizes PowerShell macros in which users are tricked into opening an attached document to enable macros and trigger a PowerShell command which attempts to download Emotet from compromised sites.

Emotet can target legitimate websites with WordPress themes by using arbitrary file upload vulnerability in which file mime type is not checked by server or code while attacker uploads backdoor script and the uploaded folder on given websites is directly accessible. Recently, this malware now provides Malware-as-a-Service (MaaS) to other malware groups to rent access to the Emotet-infected computers to infect them with other malware such as Trickbot Trojan and Ryuk Ransomware.