Emotet Returns
Emails from a newly-revived Emotet botnet have one of three types of attachments:
Microsoft Excel spreadsheet
Microsoft Word document
Password-protected zip archive (password: BMIIVYHZ) containing a Word document These emails were all spoofed replies that used data from stolen email chains, presumably gathered from previously infected Windows hosts. Infection traffic for Emotet is similar to what we saw before the takedown in January 2021.
The only real difference is Emotet post-infection C2 is now encrypted HTTPS instead of unencrypted HTTP.
Featured Resources
blog
Exploiting BadSuccessor: Cymulate Launches New Advanced Breach Simulation Scenario
At Cymulate, our mission is to stay ahead of evolving threats by transforming cutting-edge research into real-world security testing tools.
blog
11 Email Threats Your Organization Needs to Know
Email remains the primary entry point for cyberattacks. From nation-state actors to low-level cybercriminals, adversaries continually exploit the ubiquity and
blog
Proactive Security in Action: What Real-World Gaps Reveal About Cyber Resilience
Today’s threat actors move fast, and reactive security is no longer enough. Most breaches have a common root cause: a