The Emotet banking Trojan works to steal vital and highly sensitive customer information by targeting banks and financial databases. Later versions are known to be introduced with spamming and malware delivery capabilities including other banking Trojans. Emotet has therefore been labeled as one of the most expensive and destructive malwares that can affect local and national governments in addition to private organizations. The malware has cost governments up to 1 million dollars per incident to combat its infectious after-effects.
The Emotet Trojan uses email spamming to spread and establish itself. Emotet works by downloading or dropping other banking Trojans; it can easily pass undetected through signature-based detection systems as well as various security layers, thanks to its polymorphic nature. It utilizes modular Dynamic Link Libraries (DLLs) to update its capabilities, making it destructive and difficult to detect. It also is aware if it’s running in Virtual machines and will become dormant to avoid detection within sandbox environments. It proliferates through many ways such as auto-start registry keys and services.
The attack spreads through malspam. Emotet will hijack your mail contact and distribute itself to those on your contact list via mail. Once the receiver downloads the infected files, the Emotet will spread. In networks that are connected, Emotet will spread by making use of common passwords saved by search engines such as Internet Explorer, Mozilla Firefox. Researchers find that Emotet uses the EternalBlue exploit to proliferate rapidly across the network.
Emotet hits multiple targets, individuals, companies and governments in the US and Europe and steals logins, financial information and crypto wallets. As the current version delivers other banking Trojans, its target audiences seem to have grown wider, infecting organizations across Canada, UK and US. An important Emotet attack was on Allentown city, PA, the cleanup of which required assistance from Microsoft’s incident response team and cost the city more than 1 million dollars.
Awareness about how the Trojan spreads is key to its prevention. You can also follow certain best practices to limit the effect of Emotet and other malspams, such as:
- Keeping computers updated with the latest MS windows patches.
- Refraining from any suspicious downloads or clicking suspect-looking links. If you stop Emotet at this stage itself, then it has no chance of gaining control over entire systems or networks.
- Learning and teaching about the importance of a strong password and using multiple factor authentications is extremely necessary.
- Organizations and banks can protect themselves and customers by having a robust plan and cybersecurity program with multiple layers of protection. Such a system is essential for real-time detection and remedy of Emotet attacks.
In cases of an existing infection, you first need to isolate the infected computer if it is connected to a network, then patch and clean it. Then move clean-up the other computers within the compromised network, one at a time. Lastly, even if such a malware attacks your system, you can mitigate the risk of a deeper impact by having a controlled layer of user access privileges & password management in place.
Here comes into play, Sectona’s Spectra Privileged Access Management solution which manages the passwords, does the timely rotation and reconciliation as per the pre-defined password policy and controls the access privileges given to users. Also, it enables the use of Multi-Factor Authentication (MFA) while granting access to your IT infrastructure for multiple sets of users.