An Old Dog with Some New Tricks

The Emotet botnet is now including stolen attachments in its phishing emails to increase the appearance of authenticity, BleepingComputer reports. The botnet is well-known for targeting the contacts of compromised email accounts with phishing emails that are sent as replies to existing email threads, but the use of legitimate, benign attachments in these emails is a new tactic.

While analyzing the ongoing wave of Emotet malspam, researchers at Cofense spotted a phishing email that contained five stolen attachments along with a malicious link in the body of the email. The attachments are meant to convince the recipient that the link itself is legitimate. If the user clicks this link, the Emotet Trojan will be installed on their system. The infected device will then be incorporated into the botnet, and the malware will attempt to repeat the process by sending phishing emails to the new victim’s contacts. Emotet also installs additional malware which will be used for more nefarious activities.

“The botnet has been delivering massive amounts of malicious spam emails — camouflaged as payment reports, invoices, employment opportunities, and shipping information — through all its server clusters starting with July 17, after more than five months of inactivity,” BleepingComputer explains. “Since it has returned to life, Emotet first started installing the TrickBot trojan on compromised Windows computers, later to switch to once again heavily spreading QakBot malware, fully replacing the TrickBot payloads.”

It’s not clear yet what QakBot is being used to accomplish, but BleepingComputer says in some cases the malware has deployed the ProLock ransomware on infected systems.

Emotet is widely viewed as one of the top cybersecurity threats because it often opens the door to more targeted and damaging attacks involving data theft and ransomware. These attacks can be prevented if users avoid clicking on emailed links or enabling macros in attachments, even if they appear to come from a trusted contact. New-school security awareness training can help your employees avoid falling for these attacks.

BleepingComputer has the story.