A new Emotet campaign is bypassing Microsoft blocks to distribute malicious OneNote files, according to Check Point Software Technologies. Check Point has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware. As reported earlier this year, […]
A new Emotet campaign is bypassing Microsoft blocks to distribute malicious OneNote files, according to Check Point Software Technologies.
Check Point has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware.
As reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files. In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file. Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.
“While big tech companies do their best to cut off cybercriminals at the earliest point, its near impossible to stop every attack from bypassing the security measures,” says Maya Horowitz, VP Research at Check Point Software.
“We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsofts latest defenses.
“The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy skepticism about the origins of an email and its contents.”
CPR also revealed that Apache Log4j Remote Code Execution was the most exploited vulnerability, impacting 44% of organisations globally, followed by HTTP Headers Remote Code Execution with 43% of organisations worldwide and MVPower DVR Remote Code Execution with a global impact of 40%.
We are here to help. Comprehensive threat and vulnerability assessments are essential to securing your organisation.
Our free Cyber Security Assessment Consulting gives you access to speak with our security experts to give you a clear understanding of your vulnerabilities.
Top malware families
Qbot was the most prevalent malware last month with an impact of more than 10% on worldwide organisations respectively, followed by Emotet and Formbook with a 4% global impact.
Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a users banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet used to be employed as a banking Trojan but has recently been used as a distributor to other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links.
FormBook – FormBook is an Infostealer targeting Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. Formbook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes and can download and execute files according to orders from its C&C.
Do you need help with your cyber-security? or would simply like to have conversation on how we can help yur business. KBS provide FREE Cyber Security Assessments. Chat with us today.
Protect your network with comprehensive security at a small business price, talk to our experts today.
#emotet #cybersecurity #malware