Researchers discover massive increase in Emotet activity

Emotet had a 730% increase in activity in September after being in a near dormant state, Nuspire discovered.

Emotet, a modular banking Trojan, has added additional features to steal contents of victim’s inboxes and steal credentials for sending outbound emails. Those credentials are sent to the other bots in its botnet which are used to then transmit Emotet attack messages.

When Emotet returned in September, it appeared with TrickBot and Ryuk ransomware to cause the most damage to a network.

“When we saw Emotet decline to a near dormant state in the second quarter, we knew it was only a matter of time until it would resurface with stronger and better tactics,” said Matt Corney, Nuspire CTO. “This significant increase in Emotet activity is one of the most dangerous malware botnets affecting the world today.”

Also noted in the report:

• 144% increase in activity correlates to TrickBot utilizing a feature called TrickBooster. This new addition gives TrickBot the ability to use the infected machine as a spam email bot. Once the victim receives the email lists the spam campaign begins operating from the victim’s computer.
• 113% increase in Hawkeye malware that is commonly sold on various hacking forums as a keylogger and stealer. This malware is typically delivered via malicious email campaigns that appear to be requesting invoices, bills of materials, order confirmations as well as other things related to normal corporate functions.
• Top 5 IoT attacks include OpenDreamBox, JawsDVR, Netcore, Netgear, D-Link.
• 97% increase in Andromeda activity sourced from Asia and the Middle East.

“The return of Emotet is a prime example of how threats may lay dormant for a while and change their tactics and techniques,” said Shawn Pope, Nuspire Senior Security Analyst. “Patching your systems and staying up to date on these changes is vital to preventing and detecting malicious threats like Emotet.”

Data reported in Nuspire’s Quarterly Threat Landscape Report correlates more than 90 billion logs across the company’s 3,000 global network sensors. Customers enterprise and mid-sized businesses operating in the automotive, franchise, manufacturing, construction healthcare and financial services industries.