Security through data

MAIN

  • Home
  • Alerts
  • Blog
  • Events
  • Incidents
  • Tutorials

FEATURED

  • IoT
  • Deep Web
  • Threat Actors
  • Social Engineering
  • Phishing
  • Malware
  • E-Commerce
  • Deepfake
  • Quantum Computing

COMPANY

  • About us
  • Advertise
  • Legal & Policy
Cybermaterial
  • CATEGORIES
    • Cyber101
      • Definition
      • Quote
    • Document
      • Cheat Sheet
      • Paper
      • Report
    • Education
      • Certification
      • Course
    • Entertainment
      • Documentary
      • Game
      • Meme
      • Movie
      • TV Show
    • Learning
      • Book
      • Lexicon
      • Podcasts
      • Tutorials
    • Tool
      • Hardware
      • Software
No Result
View All Result
Contact Us
Cybermaterial
  • CATEGORIES
    • Cyber101
      • Definition
      • Quote
    • Document
      • Cheat Sheet
      • Paper
      • Report
    • Education
      • Certification
      • Course
    • Entertainment
      • Documentary
      • Game
      • Meme
      • Movie
      • TV Show
    • Learning
      • Book
      • Lexicon
      • Podcasts
      • Tutorials
    • Tool
      • Hardware
      • Software
No Result
View All Result
Contact Us
Cybermaterial
No Result
View All Result

Alert: Emotet Malware

by CISA

in Alerts
3 min read
October 8, 2020

Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC).

Emotet—a sophisticated Trojan commonly functioning as a downloader or dropper of other malware—resurged in July 2020, after a dormant period that began in February. Since August, CISA and MS-ISAC have seen a significant increase in malicious cyber actors targeting state and local governments with Emotet phishing emails. This increase has rendered Emotet one of the most prevalent ongoing threats.

To secure against Emotet, CISA and MS-ISAC recommend implementing the mitigation measures described in this Alert, which include applying protocols that block suspicious attachments, using antivirus software, and blocking suspicious IPs.

Technical Details

Emotet is an advanced Trojan primarily spread via phishing email attachments and links that, once clicked, launch the payload (Phishing: Spearphishing Attachment [T1566.001], Phishing: Spearphishing Link [T1566.002]).The malware then attempts to proliferate within a network by brute forcing user credentials and writing to shared drives (Brute Force: Password Guessing [T1110.001], Valid Accounts: Local Accounts [T1078.003], Remote Services: SMB/Windows Admin Shares [T1021.002]).

Emotet is difficult to combat because of its “worm-like” features that enable network-wide infections. Additionally, Emotet uses modular Dynamic Link Libraries to continuously evolve and update its capabilities.

Since July 2020, CISA has seen increased activity involving Emotet-associated indicators. During that time, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected roughly 16,000 alerts related to Emotet activity. CISA observed Emotet being executed in phases during possible targeted campaigns. Emotet used compromised Word documents (.doc) attached to phishing emails as initial insertion vectors. Possible command and control network traffic involved HTTP POST requests to Uniform Resource Identifiers consisting of nonsensical random length alphabetical directories to known Emotet-related domains or IPs with the following user agent string (Application Layer Protocol: Web Protocols [T1071.001]).

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR

Traffic to known Emotet-related domains or IPs occurred most commonly over ports 80, 8080, and 443. In one instance, traffic from an Emotet-related IP attempted to connect to a suspected compromised site over port 445, possibly indicating the use of Server Message Block exploitation frameworks along with Emotet (Exploitation of Remote Services [T1210]). Figure 1 lays out Emotet’s use of enterprise techniques.

READ MORE

Tags: AlertsCISAEmotetMalwarePhishingTrojans
16
VIEWS

More Alerts

ICS Advisory (ICSA-21-056-03) – Rockwell Automation Logix Controllers
Alerts

ICS Advisory (ICSA-21-056-03) – Rockwell Automation Logix Controllers

March 1, 2021
Mozilla Releases Security Updates for Thunderbird, Firefox ESR, and Firefox
Alerts

Mozilla Releases Security Updates for Thunderbird, Firefox ESR, and Firefox

February 26, 2021
Exploitation of Accellion File Transfer Appliance
Alerts

Exploitation of Accellion File Transfer Appliance

February 26, 2021

MORE

Book

How to Lose the Information War: Russia, Fake News, and the Future of Conflict

December 2, 2020
Software

Tool: Sublist3r

November 26, 2020
Book

The Hacker Playbook 3: Practical Guide To Penetration Testing

November 23, 2020
Software

Tool: Deft Linux

October 15, 2020
ADVERTISEMENT

Tags

Books Cyber Definition Cybersecurity Hackers Malware Memes Movies Quantum Computing Software Word of the day

© 2021 | CyberMaterial | All rights reserved.

SECURITY THROUGH DATA

No Result
View All Result
  • Home
  • Alerts
  • Cyber Incidents
  • Blog
  • Events
  • Tutorials
  • Featured
    • IoT
    • Deep Web
    • Threat Actors
    • Social Engineering
    • Deepfake
    • E-Commerce
    • Malware
    • Phishing
    • Quantum Computing

© 2020 CyberMaterial - Cyber Decoded.

This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.