Stolen emails reflect Emotet's organic growth
Summary: Cisco Talos reports that Emotet uses stolen SMTP credentials and harvested email threads to send malicious messages that appear to come from known contacts, and that after compromising one or more people working for or with the U.S. government, it saw a rapid increase in infectious Emotet messages directed at the .mil and .gov top-level domains in December 2019, continuing into January 2020. Talos cites an example message sent to an individual working for U.S. Sen. Cory Booker, with a From header and signature suggesting it originated from an infected colleague at booker.senate.gov.
What's compelling: Anyone who has emailed an Emotet victim can be targeted, and the more interaction with that victim, the more likely the malicious email - which is how Emotet crossed into .mil and .gov addresses after a single government compromise. Stolen mail also means lost control of sensitive data and communications, which Emotet currently uses for social engineering but could just as easily read, parse, and act or trade on.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026