Rising Security Concerns Over the Takedown of Emotet

When Emotet roared in the wild

• As of December 2020, Emotet was the world’s popular malware, affecting 7% of organizations.
• Its massive presence made it an attractive vector for attackers looking to deploy a variety of malware, including ransomware.
• The malware also enabled cybercriminals to expand their infection base by sending spam as a botnet or collecting credentials in phishing attacks.
• By the time law enforcement intervened, Emotet had infected more than 1.6 million machines and caused hundreds of millions of dollars in damage.

Takedown brings a sigh of relief

• In 2020, Emotet along with Trickbot and ZLoader contributed to 78% of the overall loader volume.
• However, after the takedown, there has been a drastic drop in the activity since January 26.

Is the celebration short-lived?

• While the takedown operation was no less than a herculean task, there still remains uncertainty about the comeback of Emotet.
• Microsoft has warned customers not to let their guard down even after Emotet’s disruption.
• Telemetry collected by the firm revealed that the trojan was very active, launching massive campaigns every week, just before the takedown. Given the reach and role in the deployment of payloads, Emotet remains a big security threat for organizations.
• It is also likely that the operators would be preparing themselves to return with a vengeance to launch more catastrophic attacks.

Key takeaways