Trojan Emotet Returns in Spam Attacks Dropping TrickBot, Qbot

by Brendan Smith
January 26, 2021

Trojan Emotet

Emotet is extremely innovative as well as a damaging financial Trojan used to download and install and also install other malware. Very first recorded in 2014, Emotet has obtained sophisticated abilities throughout its lifetime. Today Emotet is targeting governments, firms, small companies, and also individuals, focusing on Europe, America, and also Canada.

After 2 quiet weeks, Trojan Emotet has ramped up its servers, downloading TrickBot and Qbot payloads.1 Cybercriminals behind the botnet upgraded the downloader stage by adding clean Microsoft files to packages, possibly to thwart detection by machine learning solutions.

Trojan Emotet Mailspam

A large Emotet spamming campaign is underway, bombarding customers in Lithuania, Greece, Japan, Romania, and France. The emails typically consist of stolen legitimate communication and generic short lure by the operators such as:

Please see enclosed document

Please see enclosed document

Attached to the spam messages is a document, detected as GenScript.KLH, with a malicious VBA script, detected as VBA/TrojanDownloader.Agent, that downloads Emotet trojans. Despite Emotet’s latest push, TrickBot remains well below its previous rates after disruption effort in the past weeks.

Sending
User Review
0 (0 votes)
Comments Rating 0 (0 reviews)

References

  1. Source: https://twitter.com/ESETresearch

About the author

Brendan Smith

Cybersecurity analyst with 15+ years digging into malware and threats, from early days reverse-engineering trojans to leading incident responses for mid-sized firms.

At Gridinsoft, I handle peer-reviewed breakdowns of stuff like AsyncRAT ransomware—last year, my guides helped flag 200+ variants in real scans, cutting cleanup time by 40% for users. Outside, I write hands-on tutorials on howtofix.guide, like step-by-step takedowns of pop-up adware using Wireshark and custom scripts (one post on VT alternatives got 5k reads in a month).

Certified CISSP and CEH, I’ve run webinars for 300+ pros on AI-boosted stealers—always pushing for simple fixes that stick, because nobody has time for 50-page manuals. Tools of the trade: Splunk for hunting, Ansible for automation, and a healthy dose of coffee to outlast the night shifts.

View all posts

Leave a Reply

Sending