It’s been discovered that the infamous Emotet Trojan has resurfaced with a new capability – it can check IPs on infected machines to see if malicious email senders are on spam lists, allowing hackers to send malware from an email address that’s guaranteed to get through. This is further proof that organisations need to be bolstering defenses as hackers continue to find ways to slip through the net of traditional AV and detection-based tools.
“The Emotet Banking Trojan is one of the most notorious pieces of malware in the wild, so its return comes as little surprise. Hackers are notoriously resourceful and can find ways to improve known attacks to breach the enterprise. Previously, we’ve seen cybercriminals apply polymorphic wrapping to Emotet to evade detection. Now it has gained the ability to check if the infected IP where the malicious email is being sent from is already on a spam list, allowing them to deliver more emails to inboxes without being rejected. This continuous development shows that hackers are looking to maximise financial gain to improve their ROI, helping to keep successful malware strains like Emotet an ever-present danger for the enterprise. Companies need to adopt layered cybersecurity defences that utilise virtualisation to isolate tasks within virtual machines. This renders attacks like Emotet harmless; even if an employee has opened a file, as the hacker will have nowhere to go and nothing to steal, keeping critical IP protected and helping organisations stay one-step ahead of new techniques being deployed by cybercriminals.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.