www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Submission: On December 05 via api from CA — Scanned from CA
Submission: On December 05 via api from CA — Scanned from CA
Form analysis 7 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form><form id="adl-user-report-form" novalidate="">
<div style="padding:0; margin: 0 0 0;">
<div style="width:100%;display:none;height: 35px;line-height:35px;font-size:13px;padding:0 12px;color:white;background-color:#FF3860;border-radius:2px;margin-bottom:10px; " id="adl-category-error">Please make a selection.</div>
<label style="display: block;line-height: 0; font-size: 16px; margin: 15px 0 15px;">
<input style="margin:0 8px 0 0;vertical-align: middle;transform: translateY(-0.15em);-webkit-appearance: radio;box-sizing: border-box;" type="radio" name="category" value="Plays Sound" required=""> Plays sound </label>
<label style="display: block;line-height: 0; font-size: 16px; margin: 15px 0 15px;">
<input style="margin:0 8px 0 0;vertical-align: middle;transform: translateY(-0.15em);-webkit-appearance: radio;box-sizing: border-box;" type="radio" name="category" value="Adult Content" required=""> Contains adult content </label>
<label style="display: block;line-height: 0; font-size: 16px; margin: 15px 0 15px;">
<input style="margin:0 8px 0 0;vertical-align: middle;transform: translateY(-0.15em);-webkit-appearance: radio;box-sizing: border-box;" type="radio" name="category" value="Covers the Page" required=""> Covers the page </label>
<label style="display: block;line-height: 0; font-size: 16px; margin: 15px 0 15px;">
<input style="margin:0 8px 0 0;vertical-align: middle;transform: translateY(-0.15em);-webkit-appearance: radio;box-sizing: border-box;" type="radio" name="category" value="Other" required=""> Other </label>
<h2 style="font-size:20px;font-weight:bold;color:rgb(58,58,58);text-align:left;margin:25px 0 15px;">Additional Information</h2>
<div style="width:100%;display:none;height: 35px;line-height:35px;font-size:13px;padding:0 12px;color:white;background-color:#FF3860;border-radius:2px;margin-bottom:10px; " id="adl-text-minlen-error">Please help us by describing the ad.</div>
<div style="width:100%;display:none;height: 35px;line-height:35px;font-size:13px;padding:0 12px;color:white;background-color:#FF3860;border-radius:2px;margin-bottom:10px; " id="adl-text-maxlen-error">Only 500 characters are allowed.</div>
<textarea id="adl-user-feedback" style="box-sizing:border-box;resize: none; margin:0;width:100%;font-size:14px;line-height:18px;height:100px;border:1px solid #B0B0B0;padding:11px 15px;border-radius:2px;" minlength="3" maxlength="500"
placeholder="What does the ad say, who is the advertiser, what does the ad look like?" name="user_feedback"></textarea>
</div>
<button type="button"
style="margin-left:auto;margin-right:auto;margin: 20px auto 0;width:200px;cursor:pointer;background-color:#7c6bf7;display:block;color:#fff;border-radius:2px;border:none;padding:15px 40px;font-weight:700;text-align:center;box-sizing:border-box;font-size:16px;"
id="adl-report-ad-modal__submit-button">Report ad</button>
</form>Text Content
*
*
*
*
*
*
* News
* Featured
* Latest
* FBI: Cuba ransomware breached 49 US critical infrastructure orgs
* Researchers discover 14 new data-stealing web browser attacks
* Microsoft Edge now bashes Google Chrome when you download it
* Russian internet watchdog announces ban of six more VPN products
* Malicious KMSPico installers steal your cryptocurrency wallets
* Microsoft shares fix for broken Outlook search in Windows 11
* Microsoft reverses Windows 11's annoying default browser setting changes
* This CompTIA cybersecurity training is only $9 in a Cyber Week deal
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Emotet malware is back and rebuilding its botnet via TrickBot
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
EMOTET MALWARE IS BACK AND REBUILDING ITS BOTNET VIA TRICKBOT
By
LAWRENCE ABRAMS
* November 15, 2021
* 03:04 PM
* 0
The Emotet malware was considered the most widely spread malware in the past,
using spam campaigns and malicious attachments to distribute the malware.
Emotet would then use infected devices to perform other spam campaigns and
install other payloads, such as the QakBot (Qbot) and Trickbot malware. These
payloads would then be used to provide initial access to threat actors to deploy
ransomware, including Ryuk, Conti, ProLock, Egregor, and many others.
At the beginning of the year, an international law enforcement action
coordinated by Europol and Eurojust took over the Emotet infrastructure and
arrested two individuals.
PLAY Top Articles Video Settings Full Screen About Connatix V140482 Read More
Read More Read More Read More Read More Read More The Week in Ransomware ‑
December 3rd 2021‑ Seizing Bitcoin 1/1 Skip Ad Continue watching after the ad
Visit Advertiser website GO TO PAGE
German law enforcement used the infrastructure to deliver an Emotet module
that uninstalled the malware from infected devices on April 25th, 2021.
EMOTET RETURNS AFTER LAW ENFORCEMENT OPERATION
Today, Emotet research group Cryptolaemus, GData, and Advanced Intel have begun
to see the TrickBot malware dropping a loader for Emotet on infected devices.
While in the past Emotet installed TrickBot, the threat actors are now using a
method that the Cryptolaemus group calls "Operation Reacharound," which rebuilds
the botnet using TrickBot's existing infrastructure
Emotet expert and Cryptolaemus researcher Joseph Roosen told BleepingComputer
that they had not seen any signs of the Emotet botnet performing spamming
activity or found any malicious documents dropping the malware.
This lack of spamming activity is likely due to the rebuilding of the Emotet
infrastructure from scratch and new reply-chain emails being stolen from victims
in future spam campaigns.
Cryptolaemus has begun analyzing the new Emotet loader and told BleepingComputer
that it includes new changes compared to the previous variants.
"So far we can definitely confirm that the command buffer has changed. There's
now 7 commands instead of 3-4. Seems to be various execution options for
downloaded binaries (since its not just dlls)," Cryptolaemus researchers told
BleepingComputer.
Advanced Intel's Vitali Kremez has also analyzed the new Emotet dropper and
warned that the rebirth of the malware botnet would likely lead to a surge in
ransomware infections.
"It is an early sign of the possible impending Emotet malware activity fueling
major ransomware operations globally given the shortage of the commodity loader
ecosystem," Kremez told BleepingComputer in a conversation.
"It also tells us that the Emotet takedown did not prevent the adversaries from
obtainging the malware builder and setting up the backend system bringing it
back to life."
Samples of the Emotet loader dropped by TrickBot can be found at Urlhaus.
Kremez told BleepingComputer that the current Emotet loader DLL has a
compilation timestamp of "6191769A (Sun Nov 14 20:50:34 2021)."
DEFENDING AGAINST THE NEW EMOTET BOTNET
Malware tracking non-profit organization Abuse.ch has released a list of command
and control servers utilized by the new Emotet botnet and strongly suggests
network admins block the associated IP addresses.
Unfortunately, the new Emotet infrastructure is growing rapidly, with over
246 infected devices already acting as command and control servers.
Network administrators are strongly advised to block all associated IP
addresses to prevent their devices from being recruited into the newly reformed
Emotet botnet.
Update 11/16/21: Updated to include source of Operation RA.
RELATED ARTICLES:
Flubot Android malware now spreads via fake security updates
Emotet botnet comeback orchestrated by Conti ransomware gang
Here are the new Emotet spam campaigns hitting mailboxes worldwide
Microsoft Defender scares admins with Emotet false positives
Over nine million Android devices infected by info-stealing trojan
* Botnet
* Emotet
* Malware
* TrickBot
* Trojan
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes Windows, malware removal, and computer
forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation,
Recovery, and Administration Field Guide and the technical editor for Rootkits
for Dummies.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Nine WiFi routers used by millions were vulnerable to 226 flaws
* Russian internet watchdog announces ban of six more VPN products
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2021 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT
WHY ARE YOU REPORTING THIS AD?
Please make a selection.
Plays sound Contains adult content Covers the page Other
ADDITIONAL INFORMATION
Please help us by describing the ad.
Only 500 characters are allowed.
Report ad
Thank you for letting us know.
Powered by
×