Emotet’s New Strategy: Exploiting Microsoft OneNote to Spread Malware and How Mjolnir Security Can Help

Introduction

Emotet, a notorious banking Trojan, has been wreaking havoc in the cybersecurity world for years. With its sophisticated and ever-evolving techniques, this malware has become a significant threat to individuals and organizations alike. In this blog post, we’ll discuss how Emotet is now utilizing Microsoft OneNote to spread its malicious code, highlighting the need for increased awareness and improved security measures. Additionally, we’ll explore how Mjolnir Security tracks Emotet beacons and can detect compromised victims, offering a valuable resource for those looking to safeguard their systems.

The Evolution of Emotet

Originally discovered in 2014, Emotet began as a simple banking Trojan, stealing financial information from unsuspecting users. Over time, it evolved into a sophisticated malware delivery platform, spreading other types of malware, such as ransomware and info-stealers. Its modular architecture allows it to adapt and change tactics rapidly, making it difficult for security experts to keep up.

Emotet’s New Playground: Microsoft OneNote

Recently, cybersecurity researchers have discovered a new attack vector employed by Emotet: Microsoft OneNote. OneNote, part of the Microsoft Office suite, is a popular note-taking and organization tool used by millions of individuals and businesses worldwide. This makes it an attractive target for cybercriminals looking to exploit its widespread use.

The Attack Method

In this new attack vector, Emotet is spreading through malicious OneNote files sent via phishing emails. The emails, often disguised as invoices, payment notifications, or other seemingly legitimate messages, contain a link to a OneNote file hosted on a compromised SharePoint or OneDrive account.

Once the victim clicks the link and opens the OneNote file, they are presented with a message instructing them to enable content to view the document. Enabling content allows macros embedded in the document to run, which in turn downloads and executes the Emotet payload. This action compromises the victim’s computer and potentially any connected network systems.

Mjolnir Security: Tracking Emotet Beacons and Detecting Compromised Victims

Mjolnir Security is a leading cybersecurity firm specializing in tracking and detecting advanced threats like Emotet. Their innovative approach involves monitoring Emotet beacons, which are signals sent by the malware to communicate with its command and control servers. By tracking these beacons, Mjolnir Security can identify compromised victims even before the victims themselves are aware of the breach.

Check our realtime tracker here: https://mjolnirsecurity.com/emotet-and-trickbot-tracker/

Additionally, Mjolnir Security offers comprehensive solutions to help organizations strengthen their cybersecurity posture. These services include:

1. Threat intelligence: Mjolnir Security gathers and analyzes threat data from various sources to provide actionable intelligence that organizations can use to protect their systems against Emotet and other malware.
2. Incident response: In the event of a security breach, Mjolnir Security’s expert team can swiftly respond, investigate, and remediate the issue, minimizing the damage and helping to prevent future attacks.
3. Proactive defense: Mjolnir Security can assist in implementing robust security measures, such as email filtering, intrusion detection systems, and endpoint protection, to prevent malware from infiltrating your network.
4. Training and education: Mjolnir Security offers training programs to educate employees on the latest cybersecurity threats and best practices, empowering them to become an active line of defense against Emotet and other cyber threats.

Conclusion

As Emotet continues to evolve and find new ways to spread its malicious code, it’s essential to stay informed and take necessary precautions to protect your digital assets. By leveraging the expertise and innovative solutions offered by Mjolnir Security, you can minimize the risk of falling victim to Emotet and other similar malware. Staying vigilant, adopting best practices for cybersecurity, and partnering with a trusted security provider like Mjolnir Security can help you safeguard your organization against the ever-evolving threats posed by cybercriminals.

IOCs
MD5 hashes
9708680347a58e18f41c0e211032e563
9313a883ff85f0384ac4276bdab8937b
ae25f2104967b2708ac9dba80aac52fd
bfc060937dc90b273eccb6825145f298

SHA1 hashes
81c8b1069382ea1dcd1afe7283c28e4de73b339d
8638c0f0ed7905ab7e7ad5eada3d9d621bb5a7e0
7ac0150b43cbb5eeba9a0f956e1291df6790f3bf
c156c00c7e918f0cb7363614fb1f177c90d8108a

SHA256 hashes
a1a3160e424b860659a73a579a5f01fe0caeb14517da015b3095a86231642b0f
5eeb3c3ae69941127e6c03581fc6274614e2d934631cca6c82cda688fb1ebadc
11b3d1564b12934489281250c9a683f076fe10254bfdd7da72307e538838ec56
2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253

URLs
hxxp[:]//malli[.]su[:]80/img/PXN5J/
hxxps[:]//kts[.]group/35ccbf2003/jKgk8/
hxxps[:]//olgaperezporro[.]com/js/ExGBiCZdkkw0GBAuHNZ/
hxxps[:]//4fly[.]su[:]443/search/OfGA/
hxxp[:]//staging-demo[.]com/public_html/wTG/
hxxp[:]//semedacara[.]com[.]br/ava/ahhz/
hxxp[:]//hypernite[.]5v[.]pl/vendor/hvlVMsI9jGafBBTa/
hxxp[:]//www[.]polarkh-crewing[.]com/aboutus/EUzMzX7yXpP/
hxxp[:]//efirma[.]sglwebs[.]com/img/2mmLuv7SxhhYFRVn/
hxxp[:]//uk-eurodom[.]com/bitrix/9HrzPY66D1F/
hxxp[:]//1it[.]fit/site_vp/4PwK3s6Bf9K7TEA/
hxxps[:]//thailandcan[.]org/assets/ulRa/

Reference(s)
Bleeping Computer, Cyble, The Hacker News