Emotet Botnet Takes a Brief Hiatus From Malware Spamming

Threat Watch

Threat Watch Emotet Botnet Takes a Brief Hiatus From Malware Spamming

Emotet Botnet Takes a Brief Hiatus From Malware Spamming

Recently, following the release of the public website “HaveIBeenEmotet.com” to allow companies to search for their domain name and find out if they’ve been targeted, Emotet has paused their spamming campaigns, presumably to retool. For the past week, there’s been no spam seen from Emotet, and module distribution has been few and far between. Additionally, the IP buffers have been much more static, with the first change since the 5^th seen today (October 13^th, 2020).

ANALYST NOTES

In this downtime, Binary Defense recommends visiting paste.cryptolaemus.com and blocking the list of current Command and Control (C2) servers. Additionally, Binary Defense recommends the use of a 24/7 SOC monitoring solution, like Binary Defense’s own Security Operations Task Force to prepare for Emotet’s return. Constant auditing of newly installed tasks, services, and run keys, is an effective way of ensuring that if Emotet manages to install, it will be detected and won’t stay on the system for long.

The war in Ukraine and its impact on how China views Taiwan

Digging through Rust to find Gold: Extracting Secrets from Rust Malware

5 Critical Criteria for evaluating Managed Detection & Response (MDR)

How Ransomware Capabilities Are Evolving and What You Can Do to Keep Your Organization Secure

Threat Watch