Forest Global Training Partners

Cyber Risks · Cisco Talos

Emotet resumes spam operations, switches to One Note

Summary: After returning to spamming operations on March 16, 2023, Emotet distributed OneNote documents alongside heavily padded Word files, including one ZIP archive of roughly 646KB that extracted to a Word document of about 500MB filled with 0x00 bytes and excerpts from "Moby Dick" to exceed sandbox and antivirus file-size limits. The OneNote files, such as one posing as a U.S. Internal Revenue Service form, prompt the recipient to click inside the document, which executes an embedded WSF script containing VBScript, later replaced by a heavily obfuscated JavaScript downloader named "Object1.js" that retrieves the Emotet payload from an attacker-controlled server.

Key Takeaway: Emotet changed its infection chain several times in a short period, moving from macro-bearing Word documents to OneNote files with embedded scripts after Microsoft deployed new macro protections, so controls tuned to one attachment type or file size will miss the next iteration.

Read the original at Cisco Talos ↗

Topics
Malware
Related