The Emotet botnet is now including stolen attachments in its phishing emails to increase the appearance of authenticity, BleepingComputer reports. The botnet is well-known for targeting the contacts of compromised email accounts with phishing emails that are sent as replies to existing email threads, but the use of legitimate, benign attachments in these emails is a new tactic.
While analyzing the ongoing wave of Emotet malspam, researchers at Cofense spotted a phishing email that contained five stolen attachments along with a malicious link in the body of the email. The attachments are meant to convince the recipient that the link itself is legitimate. If the user clicks this link, the Emotet Trojan will be installed on their system. The infected device will then be incorporated into the botnet, and the malware will attempt to repeat the process by sending phishing emails to the new victim’s contacts. Emotet also installs additional malware which will be used for more nefarious activities.
“The botnet has been delivering massive amounts of malicious spam emails — camouflaged as payment reports, invoices, employment opportunities, and shipping information — through all its server clusters starting with July 17, after more than five months of inactivity,” BleepingComputer explains. “Since it has returned to life, Emotet first started installing the TrickBot trojan on compromised Windows computers, later to switch to once again heavily spreading QakBot malware, fully replacing the TrickBot payloads.”
It’s not clear yet what QakBot is being used to accomplish, but BleepingComputer says in some cases the malware has deployed the ProLock ransomware on infected systems.
Emotet is widely viewed as one of the top cybersecurity threats because it often opens the door to more targeted and damaging attacks involving data theft and ransomware. These attacks can be prevented if users avoid clicking on emailed links or enabling macros in attachments, even if they appear to come from a trusted contact. New-school security awareness training can help your employees avoid falling for these attacks.
BleepingComputer has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW