TA542, a cybercriminal group that distributes Emotet malware, has ended its summer break and is launching more and more new campaigns. However, also with modified Emotet variants.
Group TA542 was absent for almost four months and was last seen in action in the summer of July 13, 2022. Since November 2, Proofpoint's security specialists have been monitoring new activities by TA542 - especially in Germany.
Key takeaways on the Emotet campaigns
- TA542 uses customized Emotet variants in the new campaigns. The changes (see below) affect the payloads and bait used as well as changes to the Emotet modules, the loader and the packer.
- Emotet now also delivers the banking Trojan IcedID.
- The new activities indicate that Emotet is regaining its full functionality as a distribution network for various strains of malware.
- The botnet has some key differences from previous campaigns. This indicates that new operators or new management are involved.
- TA542's email campaigns are among the cybercrime leaders in terms of email volume. Proofpoint has already blocked hundreds of thousands of messages per day.
- The Excel file containing the malware includes instructions for potential victims to copy the file to a Microsoft Office template location and run it from there. Administrator rights are required for this. This applies more to private computers than to company computers.
The main innovations of Emotet
- New visual decoys for Excel attachments
- Changes to the Emotet binary
- Emotet uses a new version of the IcedID loader
- In addition to IcedID, the malware downloader Bumblebee is used
Proofpoint's cybersecurity experts anticipate that TA542 will continue to adapt their method, with the potential for higher email volumes, more targeted regions, and new variants or techniques of attached or linked malware. The changes that have already been made to the Emotet binary suggest that the cyber criminals will continue to customize it as well.
Emotet: Experts expect strong rise
Everything indicates that Emotet will regain its full functionality as a distribution network for many major malware families. What is particularly interesting is that Emotet is evolving. We've been watching it for years and there's no sign of it ceasing operations. It keeps dying and reviving like a cat with more than nine lives.
More at Proofpoint.com
About Proofpoint Proofpoint, Inc. is a leading cybersecurity company. The focus for Proofpoint is the protection of employees. Because these mean the greatest capital for a company, but also the greatest risk. With an integrated suite of cloud-based cybersecurity solutions, Proofpoint helps organizations around the world stop targeted threats, protect their data, and educate enterprise IT users about the risks of cyberattacks.