The Threat and Impact of Emotet: Why It’s a Hot Topic Now

Today, enterprises and local governments are advancing ICT, and administrative processes have become more efficient. However, threats have also emerged in various forms. One of these is the malware “Emotet,” which attempts to infiltrate and steal confidential information without being noticed by ICT and security personnel. This article will explain the threat of “Emotet,” from its overview to potential damages and preventive measures.

What is Emotet?
Emotet Targets and Infection Routes
Why Has Emotet Gained Attention as a Threat?

Emotet Itself is Not Dangerous Code
Disguised as Excel, Word, and PDF Files for Installation
Disguise That Doesn’t Raise Suspicion of Malicious Emails

Damage Caused by Emotet Infection
How to Suppress the Threat of Emotet

Prevent the Threat of Infection
Establish a Safe File Sharing Method with the Other Party
Establish Response Procedures in Case of Emotet Infection

Summary

1. What is Emotet?

Emotet is a type of malware that has become widely known since around 2019. In fact, the malware called Emotet was first detected in 2014.

The malware called Emotet is also known as a Trojan horse and is responsible for sending other malware to infected computers. The threats sent in this way can be broadly classified into two types.

One is a type called Trickster, which is malware aimed at gaining access to bank account login data. The other is a type called Ryuk, which aims to encrypt computer data and prevent access to that data or the entire system. Some people may be more familiar with the term “ransomware” for this “Ryuk” type.

2. Emotet Targets and Infection Routes

In modern times, no computer is immune to cyber attacks, including Emotet.

Emotet’s main infection route is email. Attackers often intervene in email exchanges between company personnel and infect the personnel by having them execute attached files containing Emotet. In addition, “spam attacks” are also carried out, in which malicious emails containing Emotet are sent indiscriminately without targeting specific individuals.

In many cases, these maliciously sent emails have Excel or Word files attached, and these files contain macros. Office prompts users to confirm whether to execute the content if a file contains macros or other such elements.

However, if the recipient does not notice this or is an employee who is unaware of these attack methods, they may enable the content without being cautious. As a result, the written macros are executed, and the recipient’s computer becomes infected with Emotet.

3. Why Has Emotet Gained Attention as a Threat?

Emotet is not the only program that infiltrates computers to steal information or interfere with the normal operation of computers.

However, the reason why Emotet is positioned as a threat that is distinct from conventional computer viruses and malware can be found in the characteristics of Emotet.

3-1. Emotet Itself is Not Dangerous Code

If the Emotet malware itself contains dangerous code, the Emotet itself will be easily removed by the security software used by many computer users.

However, in order to bypass security personnel and antivirus software, Emotet itself does not contain malicious code. Even if Emotet invades a terminal, Emotet itself does not cause malicious behavior to the terminal. Instead Emotet acts as a “tunnel” or “transport truck” for invading other malware into that terminal. It is easy to understand if you think of Emotet as a “tunnel” or “transport truck” for invading other malware into that terminal.

By having these characteristics, Emotet has acquired the property of being easily infected to many terminals without being easily removed.

3-2. Disguised as Excel, Word, and PDF Files for Installation

If the Emotet code is a disguise to deceive security personnel and security software, the file in which the code for infecting Emotet is written can be said to be a disguise to deceive the personnel actually using the computer.

Previous computer viruses were attached with executable files such as “.exe”, and measures for these files have been relatively established.

However, Emotet, which has become a hot topic in recent years, uses file formats such as Excel and Word files, which are routinely exchanged between companies. For this reason, it creates the misconception that the file is attached from a legitimate sender, and the recipient opens the file and executes the code without caution.

3-3. Disguise That Doesn’t Raise Suspicion of Malicious Emails

A characteristic of emails sent by attackers to infect Emotet is that they “naturally intervene in email exchanges.”

This disguise is, for example, an email with “Re:” in the subject line to indicate that it is a reply, or it is disguised as an email that the recipient is likely to receive on a daily basis. This is one of the reasons why Emotet is considered a threat.

4. Damage Caused by Emotet Infection

As mentioned earlier, Emotet does not cause damage to the computer itself, but rather plays the role of helping other malware invade.

Since Emotet has a worm function, that is, a self-proliferation function, it is necessary to be wary of the spread of infection to other computers on the network if one computer in the organization is infected.

Furthermore, attacks may be carried out that not only steal information but also make the computer unusable.

5. How to Suppress the Threat of Emotet

As mentioned above, Emotet is characterized by its high potential to infect computers by bypassing existing security measures and knowledge of cyber attacks. How should computer users take measures against this threat of Emotet?

5-1. Prevent the Threat of Infection

First of all, it is important to prevent the threat of infection so that infection with Emotet does not occur. Having knowledge that Emotet uses email as the main infection route is of great help in infection control.

Establishing a habit of confirming that the sender of an email is a legitimate party, such as checking the domain and sender of received emails, is one measure that can be taken immediately. Also, it is effective as a measure not to easily execute the macros of files attached to received emails.

As a measure to suppress the execution of macros, it is effective not only to educate employees, but also to take measures on the Office software side. By setting “Disable macros” in the settings, you can prevent macros in inadvertently received files from being executed.

5-2. Establish a Safe File Sharing Method with the Other Party

In the case of Emotet infection from files attached to emails, the problem is that as long as the sender is a third party with malicious intent, the macro can be executed as long as they know the recipient’s email address.

This problem can be somewhat alleviated by excluding email from the file sharing method options. As an example, a method of using the sharing function of a cloud storage service can be considered.

However, it is necessary to check whether the access URL to the cloud storage is a malicious link. It is also effective to decide in advance where to place files on the cloud storage with related parties and prohibit other sharing methods.

5-3. Establish Response Procedures in Case of Emotet Infection

Establishing response procedures in the event of Emotet infection does not help prevent Emotet infection, but it makes a world of difference in how to respond after infection.

Examples include establishing procedures for isolating infected computers from the network, establishing procedures for contacting relevant parties, and creating backups, alternative terminals, and alternative procedures to prevent disruption to operations in the event that a computer becomes unusable due to a ransomware-type infection.

Summary

Emotet, which has been a hot topic in the ICT environment in recent years, is considered a major threat because existing countermeasures against computer viruses and the like are almost ineffective. In addition, because Emotet itself is used as a procedure to guide other malware, security software that detects and completely removes Emotet itself has not yet been developed.

For measures against Emotet, measures in the areas of knowledge and knowledge, such as knowledge of attack methods and the establishment of response procedures by the individuals or company personnel who handle computers, are effective above all else.

For further assistance, please contact globalsupport@jiran.com.