TA542 Returns With Emotet: What's Different Now
Researchers report the TA542 threat group has made code changes to its malware and started targeting new locations with Emotet.
TA542, a threat group known for distributing Emotet malware, returned this summer following a hiatus that spanned from Feb. 7 through July 17. Now back, its email campaigns are the most rampant by message volume, which is roughly the same as it was before its break.
Proofpoint researchers watching TA542 say aside from some new techniques and incremental changes, the group has made "surprisingly minimal change" in its tactics or tooling considering the length of time it was gone.
Significant updates include the distribution of the Qbot affiliate "partner01," replacing The Trick as the primary malware payload delivered by Emotet. Researchers also noticed a change in the Emotet sending module, which can now deliver benign attachments in addition to malicious ones. Emails usually have a malicious URL or attachment; they sometimes, but rarely, include both.
Smaller changes were seen in the emails themselves, where researchers noticed a "significant volume" of thread hijacking and language localization. TA542 continues to leverage generic lures, as well as news-related bait related to COVID-19 and other topics. Similar to before the break, TA542 uses Word attachments with macros, PDF attachments, and URLs linking to Word files.
The group continues to target a core set of regions, including Germany, Austria, Switzerland, the United States, United Kingdom, and Canada. Now researchers see attackers expanding to test new geographies, such as Indonesia, the Philippines, Sweden, and India.
"Whether they iterate and change their tactics or continue in the same manner, Emotet remains a highly dangerous threat," researchers state.
Read the full analysis here.
About the Author
You May Also Like
Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024Safeguarding GitHub Data to Fuel Web Innovation
Nov 21, 2024