Emotet Summary: November 2021 Through January 2022
Summary: Emotet, a Windows-based malware family that began as a 2014 banking Trojan and is now modular malware used for information stealing, spambot activity and loading other malware, resumed operations in mid-November 2021 after a January 2021 law enforcement takedown, running on two new botnets designated epoch 4 and epoch 5. Unit 42's review through January 2022 documents recurring changes in infection chains - password-protected ZIP archives, Word and Excel documents with malicious macros, a batch-file and PowerShell step, abuse of Microsoft's App Installer protocol from Nov. 30, and fake Google Drive complaint pages - plus Cobalt Strike deployment to infected hosts confirmed by the Cryptolaemus team on Dec. 7.
What's compelling: Emotet-infected hosts act as spambots sending a dozen or more emails every minute, so hundreds of infected machines can generate hundreds of thousands of malicious emails per day, and hashbusting makes each sample's SHA256 hash different on every infected system.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026