New Emotet Infection Method
Summary: Unit 42 observed a new Emotet infection method as early as Dec. 21, 2021, in which an email delivers an Excel file containing an obfuscated Excel 4.0 macro that, once enabled, runs cmd.exe to launch mshta.exe and fetch a remote HTML application. That application pulls two stages of PowerShell, the second holding 14 URLs to retrieve the Emotet binary, which loads an encrypted PE from its resource section.
What's compelling: The chain depends on a user enabling macros on a vulnerable Windows host, and the 14 fallback URLs mean taking down one delivery host does not stop the download. Emotet was disrupted by law enforcement in January 2021 and returned in November 2021, and this variant was still sending thread-hijacked emails built from stolen June 2021 threads on Jan. 27, 2022.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026