Emotet

Emotet is a modular Windows malware family first identified in 2014 that began as a banking trojan and evolved into one of the most prominent malware delivery platforms in cybercrime. It is widely associated with large-scale spam operations and has been linked to the threat cluster commonly tracked as TA542 or Mummy Spider. Over time, Emotet shifted from primarily targeting financial data to functioning as a loader and botnet capable of delivering additional malware, including banking trojans, information stealers, ransomware, and other follow-on payloads such as TrickBot.

Emotet is best known for email-borne infection chains that rely on phishing or spearphishing lures themed as invoices, payments, shipping notices, or hijacked email threads. Delivery has historically used malicious Office documents with VBA or Excel 4.0 macros, and later expanded to formats such as XLL add-ins, zipped shortcut attachments, password-protected archives, and HTML smuggling as defenders improved macro-based detection. Typical execution chains use native Windows utilities and scripting engines, including mshta, PowerShell, rundll32, and regsvr32, to retrieve and launch staged payloads.

The malware employs obfuscation and anti-analysis measures including encrypted strings and resources, dynamic API resolution, control-flow obfuscation, runtime decryption, and polymorphic variation. Observed variants use staged execution with an initial dropper and a resident bot component. Persistence can be established through user Run keys or Windows services depending on privilege level. Emotet also stores embedded command-and-control information in its binaries and uses encrypted communications, including RSA- and AES-protected traffic over HTTP POST with randomized request structure.

Operationally, Emotet serves as an initial-access and malware-delivery platform that enables broader compromise. Reported campaigns and intrusion chains show it downloading and executing additional binaries or plugins, supporting post-compromise activity by other tooling, and acting as a precursor to ransomware deployment. It has been observed in enterprise intrusions that progressed to remote access, lateral movement, data exfiltration, and domain-wide ransomware impact. Emotet primarily targets Windows environments and has affected organizations across sectors worldwide through high-volume malicious email campaigns.