April 21, 2020 By Shane Schick 2 min read

Emotet has returned with additional modules that have been specifically designed to improve the malware’s evasion capabilities, a cybersecurity researcher warned.

In a Twitter thread this past Saturday, IT security expert Marcus Hutchins, known as MalwareTech, said botnets that have been dormant for several months have been reactivated.

One botnet he described as E2, for example, has a module designed to steal email data, while another targets system credentials. Although it originally emerged as a banking Trojan akin to Trickbot and has already been rewritten several times before, Hutchins noted Emotet appears to have undergone a complete overhaul.

Hashbusting Comes Into Play

Among the techniques embedded into botnet E2’s modules is hashbusting. By making sure each malware’s file hash looks different on every system it infects, it becomes more difficult to track it, Hutchins explained.

The cybercriminals behind the variant have also made it simpler to mutate the malware by obfuscating code flow via a state machine, he added.

This means a randomized state value can control the flow of code blocks. They are placed in an arbitrary manner, increasing the challenges for security leaders and their teams. The malware’s authors achieve this by flattening the branches into nested loops.

All this means whoever updated the malware may be getting ready to launch an attack campaign, Hutchins concluded.

Emotet has emerged as a popular tool for hackers. Earlier this month, Microsoft reported an attack where the malware brought down an entire network. In February, another variant was using wireless local area networks (WLANs) as a distribution method.

Protect Yourself From Emotet Variants

Like many similar cyberthreats, Emotet has largely been driven by phishing emails that trick victims into clicking on a link that launches the malware.

While security awareness training can help here, IT security teams can improve their odds of detecting suspicious activity by using the logging and alerting capabilities of a security information and event management (SIEM) solution. Deploying multifactor authentication (MFA) is another best practice worth applying.

More from

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

New ransomware over browser threat targets uploaded files

3 min read - We all have a mental checklist of things not to do while online: click on unknown links, use public networks and randomly download files sent over email. In the past, most ransomware was deployed on your network or computer when you downloaded a file that contained malware. But now it’s time to add a new item to our high-risk activity checklist: use caution when uploading files. What is ransomware over browsers? Researchers at Florida International University worked with Google to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today