Emotet | Jotup

Use of Malware, Botnets and Exploits Expands in Q1 2022; Mirai Sees Resurgence

Retrieved on:

Tuesday, May 10, 2022

IDC, MSSP, IOT, Light, MDR, Pain, VBA, TTP, Java, MSS, EDR, Microsoft, CSC, Denial-of-service attack, Organization, Security, Socs, CXP, Google, LinkedIn, Office, Solution, Technology, Research, Ciso Morales, Intelligence, Medical device, Risk management, Emotet

Nuspire's data show malware, botnet and exploit activity increased 4.76%, 12.21% and 3.87% respectively in Q1 2022.

Key Points:

Nuspire's data show malware, botnet and exploit activity increased 4.76%, 12.21% and 3.87% respectively in Q1 2022.
Nuspire's data revealed a significant number of new vulnerabilities leading to increases in threat actor activity across all three of the threat classifications it studies: malware, botnets and exploits.
Of note are several older botnets that saw a resurgence in Q1, including Mirai, STRRAT and Emotet.
Mirai, known for co-opting IoT devices to launch DDoS attacks, showed a spike in activity in February 2022.

Avast Q1/2022 Threat Report: Cyber Warfare in Ukraine and Russia Dominates the Threat Landscape

Retrieved on:

Thursday, May 5, 2022

PRAGUE, May 5, 2022 /PRNewswire/ -- Avast (LSE:AVST), a global leader in digital security and privacy, today released its Q1/2022 Threat Report which reveals cyber threats revolving around the physical war between Russia and Ukraine. The latest report shines light on a Russia-attributed APT group attacking users in Ukraine, and DDoS tools being used against targeting Russian sites, and ransomware attacks targeting companies in Ukraine. Additionally, findings show that cybergangs have been affected by the physical war, causing a slight decline in ransomware, and the temporary discontinuation of the information stealer, Racoon Stealer.

Key Points:

On the other hand, we blocked 50% less adware attacks in Russia and Ukraine, which could be due to less people going online, especially in Ukraine."
Just before the war in Ukraine began, the Avast Threat Labs tracked several cyber attacks, believed to be carried out by Russian APT groups.
Ransomware called HermeticRansom , for which Avast released a decryptor tool for, was spread, presumably also by an APT group.
With over 435 million users online, Avast offers products under the Avast and AVG brands that protect people from threats on the internet and the evolving IoT threat landscape.

March 2022’s Most Wanted Malware: Easter Phishing Scams Help Emotet Assert its Dominance

Retrieved on:

Tuesday, April 12, 2022

Researchers report that Emotet is continuing its reign as the most popular malware, impacting 10% of organizations worldwide, double that of February.

Key Points:

Researchers report that Emotet is continuing its reign as the most popular malware, impacting 10% of organizations worldwide, double that of February.
Emotet is an advanced, self-propagating and modular trojan that uses multiple methods for maintaining persistence and evasion techniques to avoid detection.
This was solidified even further this month as many aggressive email campaigns have been distributing the botnet, including various Easter-themed phishing scams exploiting the buzz of the festivities.
By theming their phishing emails around seasonal holidays such as Easter, they are able to exploit the buzz of the festivities and lure victims into downloading malicious attachments that contain malwares such as Emotet.

New WatchGuard Threat Lab Report Shows Network Attacks at Highest Point Over Last Three Years

Retrieved on:

Tuesday, April 5, 2022

Network detections also continued an upward trajectory, with the Americas receiving the majority of attacks.

Key Points:

Network detections also continued an upward trajectory, with the Americas receiving the majority of attacks.
WatchGuard Technologies, Inc. is a global leader in network security, endpoint security, secure Wi-Fi, multi-factor authentication and network intelligence.
For additional information, promotions and updates, follow WatchGuard on Twitter ( @WatchGuard ), on Facebook , or on the LinkedIn Company page.
WatchGuard is a registered trademark of WatchGuard Technologies, Inc. All other marks are property of their respective owners.

MITRE Engenuity ATT&CK® Evaluations Highlight Check Point Software’s as a Leader in Endpoint Security with 100% Detection Across all Attack Steps

Retrieved on:

Friday, April 1, 2022

Organization, Petya (malware), NASDAQ, Attack, General manager, ATT, MITRE, GLOBE, Solution, APT, SAN, Risk management, Medical imaging, Emotet

MITRE Engenuitys Evaluation results highlight Check Point Harmony Endpoints ability to immediately and automatically block, remediate, and recover from ransomware and other cyber threats before the damage spreads.

Key Points:

MITRE Engenuitys Evaluation results highlight Check Point Harmony Endpoints ability to immediately and automatically block, remediate, and recover from ransomware and other cyber threats before the damage spreads.
Harmony Endpoint delivered 100% detection of all attack steps with the highest Technique detection level and zero delays in alerting detections.
For this evaluation, MITRE Engenuity tested 30 endpoint security providers and their products.
The latest ATT&CK Evaluations results highlight Check Point Harmony Endpoints leadership for the 2nd consecutive year, as an industry-leading threat detection and full attack visibility capabilities.

February 2022’s Most Wanted Malware: Emotet Remains Number One While Trickbot Slips Even Further Down the Index

Retrieved on:

Wednesday, March 9, 2022

Researchers report that Emotet is still the most prevalent malware, impacting 5% of organizations worldwide, while Trickbot has slipped even further down the index into sixth place.

Key Points:

Researchers report that Emotet is still the most prevalent malware, impacting 5% of organizations worldwide, while Trickbot has slipped even further down the index into sixth place.
During the past few weeks, however, Check Point Research, has noted no new Trickbot campaigns and the malware now ranks sixth in the index.
This could be due in part to some Trickbot members joining the Conti ransomware group, as suggested in the recent Conti data leak.
Emotet, once used as a banking Trojan, has recently been used as a distributer to other malware or malicious campaigns.

Deep Instinct 2022 Threat Landscape Report Finds 125% Increase in Threat Types and Novel Evasion Techniques

Retrieved on:

Monday, February 28, 2022

Deep Instinct , the first company to apply end-to-end deep learning to cybersecurity, today unveiled findings from its bi-annual Threat Landscape Report .

Key Points:

Deep Instinct , the first company to apply end-to-end deep learning to cybersecurity, today unveiled findings from its bi-annual Threat Landscape Report .
Deep Instinct was founded to bring a new approach based on deep learning to cybersecurity.
Defense evasion and privilege escalation are becoming more prevalent and we expect to see a continuation of EPP/EDR evasion techniques in 2022.
The Deep Instinct Prevention Platform is an essential addition to every security stackproviding complete, multi-layered protection against threats across hybrid environments.

DARKTRACE AI CONTAINS EMOTET TROJAN CYBER-ATTACK AT SAUDI ARABIAN CONSTRUCTION SUPPLY GIANT

Retrieved on:

Thursday, February 24, 2022

Software as a service, Technology, Business, Algorithm, Organization, TIME, Weapon, Emotet, Darktrace

Darktrace's Self-Learning AI spotted that a company device was compromised by Emotet, an infamous trojan that rapidly spreads malware from device to device, exfiltrating sensitive financial information.

Key Points:

Darktrace's Self-Learning AI spotted that a company device was compromised by Emotet, an infamous trojan that rapidly spreads malware from device to device, exfiltrating sensitive financial information.
Emotet, which had defeated static security controls in the organization, is often the pre-cursor to ransomware if left uninterrupted.
Within minutes, Darktrace AI took action to successfully block malicious communications occurring between the infected device and an unusual host.
Self-Learning AI formed a constantly evolving understanding of both IT and operational technologies at the Saudi Arabian construction giant, allowing it to identify the subtle, emerging signs of Emotet.

DARKTRACE AI CONTAINS EMOTET TROJAN CYBER-ATTACK AT SAUDI ARABIAN CONSTRUCTION SUPPLY GIANT

Retrieved on:

Thursday, February 24, 2022

Software as a service, Technology, Business, Algorithm, Organization, TIME, Weapon, Emotet, Darktrace

CAMBRIDGE, England, Feb. 24, 2022 /PRNewswire/ -- Darktrace, a global leader in cyber security AI, today announced that its Autonomous Response technology, Antigena, successfully took action to halt a recent cyber-attack targeting a construction supply enterprise in Saudi Arabia.

Key Points:

Darktrace's Self-Learning AI spotted that a company device was compromised by Emotet, an infamous trojan that rapidly spreads malware from device to device, exfiltrating sensitive financial information.
Emotet, which had defeated static security controls in the organization, is often the pre-cursor to ransomware if left uninterrupted.
Within minutes, Darktrace AI took action to successfully block malicious communications occurring between the infected device and an unusual host.
Self-Learning AI formed a constantly evolving understanding of both IT and operational technologies at the Saudi Arabian construction giant, allowing it to identify the subtle, emerging signs of Emotet.

Security Experts Discover Significant Increase in Emotet Activity in Q4 2021

Retrieved on:

Tuesday, February 22, 2022

MSSP, Pain, Ciso Morales, Intelligence, Hibernation, Organization, Trickbot, MSS, MDR, Socs, LinkedIn, CSC, CXP, Technology, Human, TTP, Solution, Log4j, EDR, Medical device, Risk management, Emotet

Earlier in 2021 Emotet, one of the most dangerous botnets in the world, was taken down by global law enforcement, which was then followed by a significant drop in Emotet activity.

Key Points:

Earlier in 2021 Emotet, one of the most dangerous botnets in the world, was taken down by global law enforcement, which was then followed by a significant drop in Emotet activity.
However, in Q4 of 2021, Nuspire security experts witnessed Emotet's return with the month of December showing activity steadily increasing throughout the month.
This increase in activity is due to Emotet rebuilding using TrickBot's existing infrastructure to grow.
"Although overall activity in 2021 compared to 2020 was on an overall decrease, major events such as Log4j and the return of Emotet dominated Q4," said JR Cunningham, Chief Security Officer at Nuspire.