Emotet Resumes Spam Campaign, Shifts from Word Documents to OneNote
Summary
Emotet resumed spam operations in March 2023, first using oversized Word documents to evade analysis, then switching to OneNote files that execute VBScript or JavaScript downloaders to install the malware.
Key points
- Emotet resumed spamming on March 7, 2023, after a months-long hiatus, and began distributing OneNote files on March 16.
- Early campaign emails attached ZIP archives containing Word documents padded with null bytes, sometimes expanding to about 500 MB, to evade file-size limits in analysis and scanning tools.
- The Word documents used malicious VBA macros to download Emotet from attacker-controlled servers.
- OneNote lures prompted recipients to click inside the document, triggering embedded objects that ran malicious VBScript or JavaScript downloaders.
- Talos reported several infection-chain changes in a short period, suggesting Emotet was adapting its approach to improve infection success.
Article Details
- Attack Vectors
- Spam emails delivered ZIP archives containing heavily padded Microsoft Word documents with malicious VBA macros that downloaded and executed the Emotet payload.
- Spam emails delivered OneNote documents that prompted recipients to click an embedded lure; the embedded object executed a WSF script with malicious VBScript or, in later examples, a JavaScript downloader.
- Documents used padding, including large quantities of 0x00 bytes and excerpts from Moby Dick, to increase file size and attempt to evade automated analysis and endpoint protection.
- Defensive Notes
- Cisco Talos said Cisco Secure Endpoint could prevent execution of the malware and Cisco Secure Email could block malicious campaign emails.
- Talos reported coverage for the threat in Snort rules and ClamAV rules.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes a heavily obfuscated JavaScript downloader.T1027.001 · Binary PaddingWord documents were padded with large quantities of inconsequential bytes to increase their size and evade automated analysis.T1059.005 · Visual BasicOneNote documents executed embedded WSF scripts containing malicious VBScript.T1059.007 · JavaScriptLater OneNote documents used an embedded JavaScript downloader to retrieve and execute the Emotet payload.T1105 · Ingress Tool TransferThe document-based downloaders retrieved the Emotet payload from attacker-controlled distribution servers.T1204.002 · Malicious FileRecipients were prompted to open attached documents and click within OneNote lures to execute embedded scripts.T1566.001 · Spearphishing AttachmentEmotet spam emails delivered ZIP archives containing malicious Word documents and OneNote attachments.
People
Malware
Vendors
CiscoCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.MicrosoftInitially leveraging heavily padded Microsoft Word documents to attempt to evade sandbox analysis and endpoint protection, the botnets switched to distributing malicious OneNote documents on March 16.
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.ClamAVClamAV Rules:Microsoft WordInitially leveraging heavily padded Microsoft Word documents to attempt to evade sandbox analysis and endpoint protection, the botnets switched to distributing malicious OneNote documents on March 16.OneNoteEmotet resumes spam operations, switches to OneNoteSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.