The FBI and Dutch Cyber Police have shared 4 million email addresses used by Emotet with the well-known leak aggregator Have I Been Pwned.
In January of this year, Europol, the FBI and law enforcement agencies around the world, including Canada, the Netherlands, France, Germany, Lithuania, the United Kingdom and Ukraine, conducted a large-scale coordinated operation to eliminate the Emotet botnet, preparations for which lasted two years.When the Emotet C&C servers were taken over by the German Federal Criminal Police Office (Bundeskriminalamt), it was used to deploy a special update to all infected hosts.
An update for Emotet, created by Bundeskriminalamt specialists, was distributed to all infected systems in the form of a 32-bit file EmotetLoader.dll. It contained a “time bomb”, the mechanism that led to the removal of Emotet from all infected machines on April 25, 2021 at 12:00 local time.
However, in addition to user computers, Emotet also hacked into a large number of mailboxes, and then used them for its operations. In this regard, representatives of the FBI decided to provide users with the opportunity to check whether they have suffered from Emotet.
To doing this, experts from the FBI and the Dutch National Unit for the Fight against Serious Technical Crimes shared with the well-known leak aggregator Have I Been Pwned 4,324,770 the email addresses that the Emotet used.
The addresses provided by HIBP belong to users from a wide variety of countries, but they are not available for simple searches. For privacy reasons, only subscribers of the service affected by Emotet are already warned of frequent compromises. That is, people will either have to confirm control of the address through the HIBP notification service, or search the domain to see if they were compromised.
Let me remind you that a similar service was launched by Dutch law enforcement officers at the beginning of the year. Apparently, in this country a database of stolen email addresses, usernames and passwords was found, and anyone now can check if they were hacked by Emotet simply by visiting the website of the Netherlands police.
Another service Have I Been Emotet was launched last fall by experts from TG Soft. It checks if Emotet has used a specific email address as sender or recipient in its malicious campaigns. However, this service was last updated before the botnet was eliminated.
