Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Malware Team Up: Malspam Pushing Emotet + Trickbot

Summary: Unit 42 reports that Emotet and Trickbot, both information-stealing banking malware distributed through malicious spam with Word document lures, are occasionally retrieved together in a single infection chain, with Trickbot using Emotet as an alternate distribution method. In a June 15, 2018 example, Emotet infected an unpatched Windows 7 client, and Trickbot then moved over SMB to an unpatched Windows Server 2008 R2 domain controller, which showed signs of infection about 20 minutes later.

Why it matters: Trickbot's SMB lateral movement reached a domain controller roughly 20 minutes after the initial Emotet infection, so a single user who enables macros on an unpatched host can hand attackers the domain.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related