TA542 Returns With Emotet: What's Different Now

TA542, a threat group known for distributing Emotet malware, returned this summer following a hiatus that spanned from Feb. 7 through July 17. Now back, its email campaigns are the most rampant by message volume, which is roughly the same as it was before its break.

Proofpoint researchers watching TA542 say aside from some new techniques and incremental changes, the group has made "surprisingly minimal change" in its tactics or tooling considering the length of time it was gone.

Significant updates include the distribution of the Qbot affiliate "partner01," replacing The Trick as the primary malware payload delivered by Emotet. Researchers also noticed a change in the Emotet sending module, which can now deliver benign attachments in addition to malicious ones. Emails usually have a malicious URL or attachment; they sometimes, but rarely, include both.

Smaller changes were seen in the emails themselves, where researchers noticed a "significant volume" of thread hijacking and language localization. TA542 continues to leverage generic lures, as well as news-related bait related to COVID-19 and other topics. Similar to before the break, TA542 uses Word attachments with macros, PDF attachments, and URLs linking to Word files.

The group continues to target a core set of regions, including Germany, Austria, Switzerland, the United States, United Kingdom, and Canada. Now researchers see attackers expanding to test new geographies, such as Indonesia, the Philippines, Sweden, and India. 

"Whether they iterate and change their tactics or continue in the same manner, Emotet remains a highly dangerous threat," researchers state. 

Read the full analysis here.