Emotet, described as "the world's most dangerous malware" before being taken down by a major international police operation, is apparently back.
Another malware botnet, TrickBot – which became the go-to for many cyber criminals following the January takedown is being used to install Emotet on infected Windows systems.
Cybersecurity researchers from AdvIntel, Crypolaemus and others have also confirmed that this does look like the return of Emotet, which appears to be using a different encryption technique from the past. Currently, Emotet isn't attempting to redistribute itself, instead relying on TrickBot to spread new infections
Emotet malware provided its controllers with a backdoor into compromised machines, which could be leased out to other groups, including ransomware gangs, to use for their own campaigns.
Emotet also used infected systems to send automated phishing emails to increase the size of the botnet, before it was taken out in January this year.
In order to protect systems from falling victim to Emotet, Trickbot and other malware loaders, it's recommended that security patches are applied when they're released to prevent cyber criminals exploiting known vulnerabilities, and that users are made aware of the dangers of phishing emails.
