Loader / botnetATT&CK S0367
Emotet
Also known as: Geodo
Emotet began as a banking trojan and grew into one of the most widespread malware delivery services, renting access to infected computers to other criminals who installed loaders and ransomware. It spread mainly through email with malicious Office documents and links, often replying inside stolen email threads to look genuine. Europol and Eurojust announced its disruption in January 2021.
- Public attribution and associated actors
- The cited sources describe Emotet as a criminal malware-as-a-service operation; this page names no group.
- First seen
- Around 2014
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0367 Emotet
Status: Infrastructure taken over and disrupted in January 2021 by an international operation coordinated by Europol and Eurojust (reported).
How it spreads or gets in
- Malicious email attachments and links, frequently inserted into hijacked real email conversations.
- Spread inside networks by guessing passwords and through administrative shares.
Key behaviours
- Ran macros and scripts to download its payload.
- Stole email content and contacts to fuel new phishing waves.
- Downloaded other malware such as TrickBot and QakBot for paying customers.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1566.002Phishing: Spearphishing Link
- T1204.002User Execution: Malicious File
- T1059.005Command and Scripting Interpreter: Visual Basic
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1110.001Brute Force: Password Guessing
- T1114Email Collection
- T1105Ingress Tool Transfer
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert when Office applications spawn script interpreters or PowerShell.
- Detect many failed logons from one internal host against shares.
- Flag replies to old email threads that carry new attachments or links.
Defences that work
- Block macros in files from the internet (Mark of the Web).
- Filter and sandbox email attachments and links.
- Enforce account lockout and strong local admin passwords.
- Treat any Emotet infection as a precursor to ransomware.