Emotet is back!

Emotet - the menacing malware

Five months of silence and now it's back: the dangerous malware Emotet - with a global spam campaign. According to the German Federal Office for Information Security (BSI), the Trojan is "one of the biggest malware threats worldwide". We explain what you should know about Emotet, how you can protect yourself, what you should do in the event of an infection and where you can find further information.

Last year, the Emotet malware compromised a number of companies and administrations, including the Berlin Court of Appeal. In autumn, it paralysed the entire infrastructure there.

The malware is so threatening that Arne Schönbohm, President of the German Federal Office for Information Security (BSI), dubbed Emotet the "king of malware" last year.

Max Mustermann

What exactly is Emotet?

Emotet is a type of malware that spreads via spam emails containing malicious Word or Excel files. The emails sent from known senders look very authentic. In addition, Emotet can latch onto conversations and send emails with fake senders as supposed replies to real emails, which makes it considerably more difficult to recognise the malware. The Trojan is installed via macros that the user has to agree to, after which it spreads worm-like over the network. Emotet then spies on confidential contact data and can join forces with other malware programmes, such as ransomware, and grant them access to the systems. The malicious programmes include the blackmail software "Ryuk" and the banking Trojan "Trickbot". As soon as these malware programmes are installed, networks can be encrypted, bank data spied out and passwords, cookies and SSH keys stolen.

New campaign, new scam

Currently, huge quantities of spam emails are being sent via a BOT that contain a Word document as an attachment or link. The Word documents contain the note that they cannot be displayed correctly because they were allegedly created under the iOS operating system. To resolve this problem, users are asked to activate the macros. New URLs, which often link to hacked WordPress pages, are also used. As soon as the macros are activated by the user, the malware is installed on the PC. It is not yet known which malware Emotet loads with the new infections.

How you can protect yourself

The new anti-virus programs already protect against this Emotet variant, but it is essential to install regular security updates. You should also promptly install the security updates provided for operating systems and application programmes. Check the sender of an e-mail carefully and do not just rely on the name displayed. Open file attachments with caution and check links contained in the message before clicking on them. Make sure you regularly back up your data and set up a separate user account on your computer for surfing and writing emails.

What you should do if your PC is infected with Emotet

If your PC is infected with the Trojan, you should change all access data stored and entered on the affected systems as quickly as possible. Potentially infected systems should be isolated from the network to prevent further spread. You should utilise the time window between the various infections. Reset all systems and change all access data and passwords. You should inform all your email contacts about the compromise, using external email addresses or ones that the attacker does not know.

Report the incident to the BSI! This information forms the basis for an IT situation report and the early warning of potential victims.

Further information

Further information on Emotet and detailed recommendations for action can be found on the pages of Allianz für Cyber-Sicherheit and the BSI.