Increased Emotet Malware Activity

Original release date: January 22, 2020

The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a recent increase in targeted Emotet malware attacks. Emotet is a sophisticated Trojan that commonly functions as a downloader or dropper of other malware. Emotet primarily spreads via malicious email attachments and attempts to proliferate within a network by brute forcing user credentials and writing to shared drives. If successful, an attacker could use an Emotet infection to obtain sensitive information. Such an attack could result in proprietary information and financial loss as well as disruption to operations and harm to reputation.

CISA recommends users and administrator adhere to the following best practices to defend against Emotet. See CISA’s Alert on Emotet Malware for detailed guidance.

Block email attachments commonly associated with malware (e.g.,.dll and .exe).
Block email attachments that cannot be scanned by antivirus software (e.g., .zip files).
Implement Group Policy Object and firewall rules.
Implement an antivirus program and a formalized patch management process.
Implement filters at the email gateway, and block suspicious IP addresses at the firewall.
Adhere to the principle of least privilege.
Implement a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system.
Segment and segregate networks and functions.
Limit unnecessary lateral communications.

CISA encourages users and administrators to review the following resources for information about defending against Emotet and other malware.