Emotet

Emotet is a long-running cybercriminal malware operation and botnet that emerged in 2014 as a banking trojan and later evolved into one of the most prominent malware loaders and initial access broker ecosystems. It is widely tracked as both a malware family and the criminal operation behind it. The operation has historically organized infected systems into separate botnets known as Epochs, including Epoch 1 through 5, with later activity centered on Epoch 4 and Epoch 5. Emotet initially focused on theft of banking credentials and financial information, then shifted toward large-scale spam-driven compromise and malware delivery. Its operators have repeatedly used malicious email campaigns, including hijacked reply-chain threads, spoofed business communications, password-protected archives, macro-enabled Office documents, Excel 4.0 macros, and later LNK-based delivery chains. Recent campaigns have used PowerShell, regsvr32, and modular DLL loaders, including 64-bit loaders, to establish infection. Once executed, Emotet commonly decrypts and reflectively loads an internal payload in memory, uses API hashing and encrypted strings for obfuscation, dynamically resolves Windows APIs, and communicates with command-and-control infrastructure over encrypted HTTP. It supports persistence through user-run keys or services and includes modules for credential theft from browsers and email clients, spam propagation, proxying, and SMB-based lateral movement. Emotet has also demonstrated defense-evasion techniques such as heavy obfuscation, benign-code insertion, anti-emulation logic, dynamic API resolution, and in-memory loading designed to hinder static and forensic analysis. The operation is notable for turning compromised hosts into a malware-as-a-service platform. Emotet infections have been used to deliver additional payloads including QakBot, TrickBot, Gootkit, Cobalt Strike, SystemBC, ransomware, information stealers, crypto-miners, and banking trojans. Security reporting has repeatedly characterized Emotet operators as prominent initial access brokers that monetize footholds by selling or leasing access to other criminal actors. Infections are frequently treated as precursors to broader enterprise compromise, data theft, and ransomware deployment. Emotet was disrupted by a major international law-enforcement action in early 2021 but resurfaced later that year and resumed global spam operations with updated delivery and evasion techniques. Post-resurrection activity has been linked in reporting to closer operational overlap with TrickBot and the Conti ecosystem, including repeated deployment of Cobalt Strike after infection. The dominant motivation is financial gain.