Loading threat actor…
Emotet is a financially motivated cybercriminal operation that develops and operates the Emotet malware botnet, also referred to as the Emotet gang, emotet_group, and Mealybug. First identified in 2014 as a banking trojan, Emotet evolved during 2016–2017 into a modular malware loader and initial-access brokerage platform. Its operators monetize compromised computers and organizational networks by providing other criminal groups with access and malware-delivery services. Campaigns target organizations globally across multiple sectors, with documented infections in Japan, France, and New Zealand. Initial access primarily relies on malicious spam, including messages sent through compromised email accounts and organizational email servers. Emotet steals credentials from browsers and email clients and abuses existing email conversations to deliver convincing reply-chain phishing messages. Delivery mechanisms have included malicious Word and Excel documents, VBA and Excel 4.0 macros, and password-protected archives containing malicious shortcut files. Later campaigns adopted PowerShell-based downloaders and 64-bit DLL loaders, with payload execution through legitimate Windows utilities. Emotet supports credential theft, data exfiltration, host reconnaissance, spam distribution, proxying, and lateral movement through SMB and Wi-Fi propagation. It establishes persistence through registry autorun entries or Windows services. Defense-evasion techniques include polymorphic packing, encrypted payloads and strings, API hashing, dynamic API resolution, anti-emulation behavior, and reflective in-memory loading. Compromised hosts communicate with command-and-control infrastructure using encrypted traffic and can receive additional modules or executable payloads. The operation historically maintained separate botnets designated Epoch 1, Epoch 2, and Epoch 3. Following an international law-enforcement disruption in January 2021, Emotet returned in November 2021, with subsequent activity tracked as Epoch 4 and Epoch 5. Emotet has maintained operational cooperation with TrickBot and delivered malware including TrickBot, QakBot, Gootkit, Cobalt Strike, and SystemBC. Its access services have enabled downstream ransomware operations, including those involving Ryuk and Conti; delivering such payloads does not itself establish that Emotet operators directly conduct ransomware extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adopted HTML smuggling as an alternative delivery method when macro-based delivery became less effective.
Mentioned only as the name of an associated analytic story in Splunk content metadata.
Mentioned only as part of an associated analytic story list for a removed Splunk detection.
A botnet operation disrupted by law enforcement; used a modular loader to steal credentials and bank details and distribute other malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.