Emotet Malware Now Hacks Nearby Wi-Fi Networks to Infect New Victims

Emotet, the notorious trojan behind a number of botnet-driven
spam campaigns and ransomware attacks, has found a new attack
vector: using already infected devices to identify new victims that
are connected to nearby Wi-Fi networks.

According to researchers at
Binary Defense^[1], the newly discovered
Emotet sample leverages a “Wi-Fi spreader” module to scan
Wi-Fi networks, and then attempts to infect devices that are
connected to them.

The cybersecurity firm said the Wi-Fi spreader has a timestamp
of April 16, 2018, indicating the spreading behavior has been
running “unnoticed” for close to two years until it was detected
for the first time last month.

The development marks an escalation of Emotet’s capabilities, as
networks in close physical proximity to the original victim are now
susceptible to infection.

How Does Emotet’s Wi-Fi Spreader Module Work?

The updated version of the malware works by leveraging an already
compromised host to list all the nearby Wi-Fi networks. To do so,
it makes use of the wlanAPI interface to extract the SSID, signal
strength, the authentication method (WPA, WPA2, or WEP), and mode
of encryption used to secure passwords.

On obtaining the information for each network this way, the worm
attempts to connect to the networks by performing a brute-force
attack using passwords obtained from one of two internal password
lists. Provided the connection fails, it moves to the next password
in the list. It’s not immediately clear how this list of passwords
was put together.

But if the operation succeeds, the malware connects the compromised
system on the newly-accessed network and begins enumerating all
non-hidden shares. It then carries out a second round of
brute-force attack to guess the usernames and passwords of all
users connected to the network resource.

After having successfully brute-forced users and their
passwords, the worm moves to the next phase by installing malicious
payloads — called “service.exe” — on the newly infected remote
systems. To cloak its behavior, the payload is installed as a
Windows Defender System Service (WinDefService).

In addition to communicating with a command-and-control (C2)
server, the service acts as a dropper and executes the Emotet
binary on the infected host.

The fact that Emotet can jump from one Wi-Fi network to the
other puts onus on companies to secure their networks with strong
passwords to prevent unauthorized access. The malware can also be
detected by actively monitoring processes running from temporary
folders and user profile application data folders.

Emotet: From Banking Trojan to Malware Loader

Emotet, which was first identified in 2014, has morphed from its
original roots as a banking Trojan to a “Swiss Army knife” that can
serve as a downloader, information stealer, and spambot depending
on how it’s deployed.

Over the years, it has also been an effective delivery mechanism
for ransomware. Lake City’s IT
network was crippled^[2]
last June after an employee inadvertently opened a suspicious email
that downloaded the Emotet Trojan, which in turn downloaded
TrickBot trojan and Ryuk ransomware.

Although Emotet-driven campaigns largely disappeared throughout
the summer of 2019, it made a comeback in
September^[3] via
“geographically-targeted emails with local-language lures and
brands, often financial in theme, and using malicious document
attachments or links to similar documents, which, when users
enabled macros, installed Emotet.”

“With this newly discovered loader-type used by Emotet, a new
threat vector is introduced to Emotet’s capabilities,” Binary
Defense researchers concluded. “Emotet can use this loader-type to
spread through nearby wireless networks if the networks use
insecure passwords.”