Windows 10: World's most dangerous malware EMOTET disrupted through global action

Brink · Jan 29, 2021

27 January 2021|PRESS RELEASE

Joint Eurojust Europol Press Release

Law enforcement and judicial authorities worldwide have this week disrupted one of the most significant botnets of the past decade: EMOTET. Investigators have now taken control of its infrastructure in an international coordinated action.

This operation is the result of a collaborative effort between authorities in the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada and Ukraine, with international activity coordinated by Europol and Eurojust. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

Read more: Worldâs most dangerous malware EMOTET disrupted through global action | Eurojust | European Union Agency for Criminal Justice Cooperation

:)

Brink · Jan 29, 2021

Emotet malware evolves with new Wi-Fi spreader

Emotet is a highly sophisticated trojan that typically also serves as a loader for other malware. A key functionality of Emotet is its ability to deliver custom modules or plugins that are suited for specific tasks, including stealing Outlook contacts, or spreading over a LAN. Recently, Binary Defense has identified a new loader type that takes advantage of the wlanAPI interface to enumerate all Wi-Fi networks in the area, and then attempts to spread to these networks, infecting all devices that it can access in the process (as seen in Figure 1).

Figure 1 Wi-Fi spreader overview
Click to expand...

Read more: Emotet Evolves With new Wi-Fi Spreader - Binary Defense

Brink · Jan 29, 2021

Mitigating and eliminating Qakbot and Emotet in corporate networks

The threat to information is greater than ever, with data breaches, phishing attacks, and other forms of information theft like point-of-sale malware and ATM hacks becoming all too common in today's threat landscape. Information-stealing trojans are in the same category of threats that deliver a steady stream of risk to data and can lead to significant financial loss.

Qakbot and Emotet are information stealers that have been showing renewed activity in recent months. These malware families are technically different, but they share many similarities in behavior. They both have the ultimate goal of stealing online banking credentials that malware operators can then use to steal money from online banking accounts. They can also steal other sensitive information using techniques like keylogging.

Figure 1. Qakbot and Emotet monthly machine encounters show an upward trend. This data doesn’t include Qakbot and Emotet variants blocked by automation and cloud rules.

Even though these malware families are typically known to target individual online banking users, more and more enterprises, small and medium businesses, and other organizations have been affected by indiscriminate infections.

Figure 2. Breakdown of Qakbot and Emotet machine encounters

Recent variants of these malware families have spreading capabilities, which can increase the chances of multiple infections in corporate networks. They can also be spread by other malware during the lateral movement stage of a cyberattack.

Typical Qakbot and Emotet kill chain

Over the years, the cybercriminals behind Qakbot and Emotet have improved the code behind their malware. They have evolved to evade detection, stay under the radar longer, and increase the chances of spreading to other potential victims.
We mapped some of the common behaviors we’ve seen in Qakbot and Emotet variants and see a lot of similarities.

Figure 3. Qakbot and Emotet attack kill chain. Note that some Qakbot and Emotet variants might not exhibit all of the behaviors above and might be capable of unique routines.

Because of similarities in behavior, Qakbot and Emotet can be mitigated by similar security measures.
Click to expand...

Read more: Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks Windows Security blog

Giridhar J · Jan 29, 2021

windows 10 - detected Malware notification - no action required.

Hi Manoj,

Thank you for posting in Microsoft Community.

I suggest you to follow the steps below and check if it helps:

Open Settings.

Click on System and click on Notifications and Actions.

Under Show notifications for these apps turn off the setting for Windows defender.

Hope this information is helpful. Please do let us know if you need further assistance, we’ll be glad to assist you.

Windows 10: World's most dangerous malware EMOTET disrupted through global action

World's most dangerous malware EMOTET disrupted through global action

World's most dangerous malware EMOTET disrupted through global action

World's most dangerous malware EMOTET disrupted through global action

World's most dangerous malware EMOTET disrupted through global action - Similar Threads - World's dangerous malware

Are these Dangerous?

Presentation World Threat Center -- Danger reporting app

Will Heat from Radiator Disrupt Data through Ethernet Cable?

Will Heat from Radiator Disrupt Data through Ethernet Cable?

I think I found a dangerous malware.

Emotet malware evolves with new Wi-Fi spreader

IoT in Action: Developing intelligent solutions that change the world

BSOD when Running Elite Dangerous mostly.

Another big malware attack ripples across the world