Japan, France, New Zealand Warn of Sudden Uptick in Emotet Trojan Attacks

“The emails contain malicious attachments or links that the
receiver is encouraged to download,” New Zealand’s Computer Emergency
Response Team^[1]
(CERT) said. “These links and attachments may look like genuine
invoices, financial documents, shipping information, resumes,
scanned documents, or information on COVID-19, but they are
fake.”

Echoing similar concerns, Japan’s CERT (JPCERT/CC) cautioned it
found a rapid increase in
the number of domestic domain (.jp) email addresses that have been
infected with the malware and can be misused to send spam emails in
an attempt to spread the infection further.
^[2]

In recent months, the malware strain has been linked to several
botnet-driven malspam campaigns and even capable of delivering more
dangerous payloads such as Ryuk ransomware by renting its botnet of
compromised machines to other malware groups.

The new uptick in Emotet activity coincides with their return on July
17^[5] after a prolonged
development period that lasted since February 7 earlier this year,
with the malware sending as many as 500,000
emails^[6] on all weekdays
targeting European organizations.

Typically spread via large-scale phishing email campaigns
involving malicious Microsoft Word or password-protected ZIP file
attachments, the recent wave of attacks have taken advantage of a
technique called email thread hijacking, using it to infect devices
with the TrickBot and
QakBot banking
Trojans.
^[8][9]

It works by exfiltrating email conversations and attachments from
compromised mailboxes to craft convincing phishing lures that take
the form of a malicious response to existing, ongoing email threads
between the infected victim and other participants in order to make
the emails seem more credible.

“TA542 also constructs phishing emails on the basis of
information collected during the compromise of mailboxes, which it
sends to exfiltrated contact lists, or more simply spoofs the image
of entities, prior victims,” the National Cybersecurity Agency of
France (ANSSI^[10]) said.

“Since returning from an extended vacation, TA542 email
campaigns are once again the most prevalent by message volume by a
large margin, with only a few other actors coming close,”
Proofpoint said in an exhaustive
analysis^[13] of Emotet last
month.

“They have introduced code changes to their malware, such as
updates to the email sending module, and picked up a new affiliate
payload to distribute (Qbot), [and] expanded targeting of countries
using native language lures.”

^{[3][4][7][11][12]}