Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Case Study: Emotet Thread Hijacking, an Email Attack Technique

Summary: Unit 42 documented an Emotet thread-hijacking case in which an infected Windows 10 host running Outlook had its most recent email stolen and used to craft a spoofed reply carrying a macro-laden Word document. The full sequence, from infection to the thread-hijacked email arriving at the original sender's Yahoo account, took one hour and 51 minutes, with 13.9 kB of encoded data sent over Emotet HTTP C2 traffic at 16:34 UTC before the spoofed message appeared at 18:22 UTC.

What's compelling: The spoofed message arrived as a reply in an existing thread from a known correspondent, which is why Unit 42 calls the technique far more effective than the malspam users have learned to spot. Headers indicated the actual sender may have been a botnet host in Brazil, and the same hijacked thread can be turned on other recipients of the original message.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related