Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

APAC’s Compromised Domains Fuel Emotet Campaign

Summary: Unit 42 reports that Emotet actors are exploiting unpatched web servers at small and mid-size enterprises across APAC - primarily in Vietnam, India, Indonesia, Australia, China and Japan - to host and distribute Emotet variants, with most of the compromised domains running WordPress. Emotet malspam and command-and-control activity resumed as of September 16, 2019 after a three-and-a-half-month break, and the number of distribution servers used in May was significantly higher than in previous months.

What's compelling: Emotet's operators rent their botnet out as Malware-as-a-Service, and it has already been the delivery path for Trickbot and then Ryuk ransomware - so an unpatched SME web server in your region is not just that company's problem, it is a trusted domain your users may click.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related