140,000 Reasons Why Emotet is Piggybacking on TrickBot in its Return from the Dead

The operators of TrickBot malware have infected an estimated
140,000 victims across 149 countries a little over a year after
attempts were to dismantle its infrastructure, even as the malware
is fast becoming an entry point for Emotet, another botnet that was
taken down at the start of 2021.

Most of the victims detected since November 1, 2020, are from
Portugal (18%), the U.S. (14%), and India (5%), followed by Brazil
(4%), Turkey (3%), Russia (3%), and China (3%), Check Point
Research noted in a report^[1]
shared with The Hacker News, with government, finance, and
manufacturing entities emerging the top affected industry
verticals.

“Emotet is a strong indicator of future ransomware attacks, as
the malware provides ransomware gangs a backdoor into compromised
machines,” said the researchers, who detected 223 different
Trickbot campaigns over the course of the last six months.

Both TrickBot and Emotet are botnets, which are a network of
internet-connected devices infected by malware and can be tasked to
conduct an array of malicious activities. TrickBot originated as a
C++ banking Trojan and as a successor of Dyre malware in 2016,
featuring capabilities to steal financial details, account
credentials and other sensitive information; laterally spread
across a network; and drop additional payloads, including Conti,
Diavol^[2], and Ryuk ransomware
payloads.

Disseminated via malspam campaigns or previously dropped by
other malware like Emotet, TrickBot^[3]
is believed to be the handiwork of a Russia-based group called
Wizard Spider^[4]
and has since extended its capabilities to create a complete
modular malware ecosystem, making it an adaptable and evolving
threat, not to mention an attractive tool for conducting a myriad
of illegal cyber activities.

The botnet also caught the attention of government and private
entities late last year, when the U.S. Cyber Command and a group of
private sector partners spearheaded by Microsoft, ESET, and
Symantec acted to blunt Trickbot’s reach^[5] and prevent the
adversary from purchasing or leasing servers for
command-and-control operations.

Emotet comes back with new tricks

But these actions have only been temporary^[6]
setbacks^[7], with the malware
authors rolling^[8]
out^[9]
updates^[10] to the botnet code that
have made it more resilient and suitable for mounting further
attacks. What’s more, TrickBot infections in November and December
have also propelled a surge in Emotet malware^[11] on compromised
machines, signaling a revival of the infamous botnet after a gap of
10 months following a coordinated law enforcement
effort^[12] to disrupt^[13] its spread.

“Emotet could not choose a better platform than Trickbot as a
delivery service when it came to its rebirth,” the researchers
noted.

The latest wave^[14] of spam attacks^[15] prompts users to
download password-protected ZIP archive files, which contain
malicious documents that, once opened and macros are enabled,
result in the deployment of Emotet malware, thereby enabling it to
rebuild its botnet network and grow in volume.

“Emotet’s comeback is a major warning sign for yet another surge
in ransomware attacks as we go into 2022,” said Lotem Finkelstein,
Check Point’s head of threat intelligence. “Trickbot, who has
always collaborated with Emotet, is facilitating Emotet’s comeback
by dropping it on infected victims. This has allowed Emotet to
start from a very firm position, and not from scratch.”

That’s not all. In what appears to be a further escalation in
tactics, new Emotet artifacts have been uncovered dropping Cobalt
Strike beacons directly onto compromised systems, according to
Cryptolaemus^[16] cybersecurity experts,
as opposed to dropping first-stage payloads before installing the
post-exploitation tool.

“This is a big deal. Typically Emotet dropped TrickBot or
QakBot, which in turn dropped Cobalt Strike. You’d usually have
about a month between [the] first infection and ransomware. With
Emotet dropping [Cobalt Strike] directly, there’s likely to be a
much much shorter delay,” security researcher Marcus Hutchins
tweeted^[17].