Emotet’s Active Campaign and Newly Adopted Techniques

The obstructing bug

• The malware distributors launched an email campaign using password-protected ZIP file attachments, including Windows LNK (shortcut) files disguised as Word documents.
• When a user double-clicks on the shortcut, it runs a command that searches the file for a particular string containing VBS code, adds found code to the new VBS file, and runs it.
• However, this command had a bug. It used a static shortcut name 'Password2[.]doc[.]lnk,' which was not matching with the real name of the attached shortcut file. Due to this mismatch, the code did not execute further.

Fixing the bug

• These shortcuts now cite the correct filenames. Upon execution, the VBS files are created successfully on the victim’s devices.
• Moreover, the actors have actively started spamming users with malicious emails containing zip files and shortcut attachments.

Active campaigns and target

• Upon infection, the malware scans for and steals email addresses for further campaigns. 
• Additionally, it drops payloads such as Cobalt Strike or other malware commonly used for ransomware attacks.
• The countries most affected by this new technique are Italy, Japan, Mexico, Canada, and Turkey.

Conclusion