Huntress Reports Emotet on 99 of 120 Client Machines
Summary
Huntress and partner SinglePoint Global report finding Emotet on 99 of 120 client machines. The article describes the malware’s persistence and spread, the response, and advice on unique administrator passwords and least privilege.
Key points
- Huntress and SinglePoint Global report that an initial review found 16 of 20 computers compromised with Emotet and Qakbot; a wider deployment found Emotet on 99 of 120 machines.
- The article says Emotet arrived through a malicious Word document delivered via an email disguised as coming from a familiar contact.
- Huntress identified persistence footholds, including malicious services and scheduled tasks; the article also describes Emotet regenerating encrypted payloads every few hours.
- An external incident response team was brought in. The article says responders initially tried scripts and an AI-backed antivirus, while SinglePoint used Huntress data to guide them to compromised hosts and contain the infection.
- The recommended precautions include unique, strong passwords for administrator accounts and limiting admin privileges to systems required for each person’s role.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Emotet and Qakbot malware infection with worm-like propagation and persistence across the client’s network
- Disclosure Date
- 2017-08-25
- Operational Impact
- Emotet was found on 99 of 120 client machines. The client dispatched an external incident response team, which spent its first 48 hours attempting remediation. The article does not report data exposure or confirmed productivity disruption.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe article describes malware reusing a compromised administrator account to access and infect other machines that account was authorized to reach.T1053.005 · Scheduled TaskThe article reports that scheduled tasks were used to automatically launch the malware and support its spread.T1110.001 · Password GuessingEmotet carried a dictionary of 340 generic passwords and used passwords to gain access to systems.T1566.001 · Spearphishing AttachmentEmotet was delivered through a malicious Word document attached to an email disguised as a message from a familiar contact.
Malware
EmotetOver the past month, the Emotet family of malware has re-emerged as a formidable piece of crimeware, thanks to its new self-propagation techniques (undoubtedly inspired by the success of WannaCry and Petya).QakbotTo gather ground-truth, SinglePoint installed Huntress on their client’s endpoints and quickly learned 16 of 20 computers were compromised with Emotet and Qakbot.