There has been a rise in malspam campaigns spreading Emotet malware in recent times, with many new campaigns initiated that spoof financial institutions – the modus operandi of the threat group behind the attacks.

The Emotet malware campaigns use Word documents including malicious macros. If macros are turned on, the Emotet malware payload is installed. The Word documents are either sent as email attachments or the spam emails contain hyperlinks which direct users to a website where the Word document is installed.

Various social engineering tricks have been used in these recent campaigns. One new tactic that was spotted by Cofense is the wrapping of malicious hyperlinks in Proofpoint’s (PFPT) TAP URL Defense wrapping service to make the email seem benign.

According to Cofense, the campaign shares Emotet malware, although Emotet in turn installs a secondary payload. In past campaigns, Emotet has been sent along with ransomware. First, Emotet steals details, then the ransomware is used to steal money from victims. In the most recent campaign, the secondary malware is the banking Trojan named IcedID.

A additional campaign has been seen that uses Thanksgiving-themed spam emails. The messages seem to be Thanksgiving greetings for employees, and similarly include a malicious hyperlink or document. The messages claim the document is a Thanksgiving card or greeting. Many of the emails have been personalized to help with the deception and include the user’s name. In this campaign, while the document downloaded seems to be a Word file, it is actually an XML file.

A new version of Emotet malware has been updated recently. Along with stealing credentials, a new module has been added that harvests emails from an infected user. The previous six months’ emails – which include subjects, senders, and message content – are illegally taken. This new module is thought to have been added to enchance the effectiveness of future phishing campaigns, for corporate espionage, and data theft.

The latest increase in Emotet malware campaigns, and the wide variety tactics used by the threat actors behind these campaigns, highlight the importance of implementing a defense in depth strategy to block phishing emails. Organizations should not rely on one cybersecurity solution to provide security against email attacks.

Phishing campaigns aim for a weak link in security defenses: Staff members. It is therefore vitaal to ensure that all employees with corporate email accounts are taught how to spot phishing threats. Training needs to be constant and should cover the latest tactics used by cybercriminals to spread malware and steal details. Staff are the last line of defense. Through security awareness training, the defensive line can be greatly strengthened.

As a frontline defense, all businesses and groups should deploy an advanced spam filtering solution. While Office 365 email includes a basic level of protection against phishing attacks, a powerful third-party anti-phishing and spam filtering solution is needed to provide protection against more complex email attacks.

SpamTitan is an advanced email filtering solution that employs predictive techniques to supply provide superior protection against phishing attacks, zero-day attacks, and new malware variants that bypass signature-based defenses.

Along with scanning message content, headers, attachments, and hyperlinks for spam and malware signatures, SpamTitan uses heuristics, machine-based learning, and Bayesian analysis to discover emerging threats. Greylisting is used to identify and block bigger spam campaigns, such as those typically carried out by the threat actors spreading banking Trojans and Emotet malware.

How SpamTitan Spam Filtering Works