With all that’s going on with COVID-19, work-from-home and economic contraction in the U.S. and globally, it’s easy for cybersecurity experts and other technologists to have missed that one of the most destructive malware strains made a surprise return in late July.

Emotet, a botnet with global reach, resurfaced on July 21 after a nearly five-month absence, according to multiple security firms, including Proofpoint and Malwarebytes. Since that time, researchers have recorded at least 800,000 spam messages associated with the malware in countries all over the world, including in the U.S., U.K., Canada, Austria, Germany, Brazil, Italy and Spain.

Waves of malware tend to come and go, but Emotet has developed a unique reputation over the years as it matured from banking Trojan to full-blown menace. When the U.S. Cybersecurity Infrastructure and Security Agency issued a warning about the botnet in January, the agency’s analysts warned about its destructive potential.

“Emotet continues to be among the most costly and destructive malware affecting [State, Local, Tribal, and Territorial] governments. Its worm-like features result in rapidly spreading network-wide infections, which are difficult to combat. Emotet infections have cost SLTT governments up to $1 million per incident to remediate,” stated the public CISA alert.

With the current Emotet campaign underway, analysts and experts warn that security and IT teams should be on the lookout for the malware and the possible destructive effects it could have on an enterprise. The campaign is also using the COVID-19 pandemic as a lure to get the unsuspecting to click on phishing emails that help power its spread.

“The campaigns usually include various payloads that have evolved over the years, primarily focused on stealing banking information or funds. Since the return of Emotet this summer, we’ve seen it using COVID-19 themes in the social engineering lures, as well as sending to recipients in a wide variety of countries,” Sherrod DeGrippo, senior director of threat research and detection at Proofpoint and well-known expert on Emotet, told Dice.

“The threat group behind Emotet is one that uses timely lures in campaigns that are truly massive in scale. In some Emotet campaigns we’ve seen over a million messages over the course of a few days,” DeGrippo added.

Emotet: A History

Emotet started life as a banking Trojan in 2014 that mainly stole financial and personal data. Over the next few years, however, the malware evolved into more of a botnet with the ability to infect multiple devices and expand its malicious network. Due to its modular nature, its creators have added new features as time went on, and it continues to evolve to this day.

In addition to the botnet, Emotet also has the ability to act as a dropper (or downloader) that can help plant other malware within a compromised device. In 2019, security experts found a triple threat: Emotet delivering another malware called TrickBot to infected endpoints, which would then download a ransomware variant called Ryuk.

These and other features are one of several reasons why warning bells ring whenever Emotet re-emerges. “Emotet is one of the most prolific malware families of the past five years. It has evolved from being specifically a banking Trojan into malware-as-a-service (MAS) with a distributed botnet infrastructure,” Jared Greenhill, director at Crypsis Group, an incident response and risk management firm, told Dice.

In the latest Emotet campaign that started in July, researchers have found that attacks start with a large-scale spam campaign that delivers phishing emails to as many victims as possible. The messages contain either a malicious attachment, a URL in the email body, or an attachment with a link. These attachments and links then deliver the initial malware infection, DeGrippo said.

If the link or attachment is opened, malicious macros are enabled that launch a PowerShell script that eventually installs Emotet within a compromised device. From there, Emotet can then download other malware. In the latest campaign, DeGrippo and others have found that it attempts to install Qbot—a banking Trojan that is known to infect financial institutions and their customers.

In some cases, the Emotet-laced message appears as part of an existing email chain, making it more likely that someone will click on the malicious link or attachments. These types of built-in social engineering techniques are a key reason why Greenhill recommends additional security training for employees to help spot this type of malware lurking in seemingly legitimate messages.

“One of the reasons Emotet is so effective is, like other types of threats, it begins with phishing tactics, and recent approaches have used brand names the recipient would be familiar with or subjects that have urgency, such as past-due notifications,” Greenhill said. “As we often see, much of the success of this malware begins with users making an error—opening a malicious attachment. A very important remedy to this is rigorous end-user training on spotting malicious emails, attachments, links, and senders, even if the sender appears legitimate.”

Fighting Back

While Emotet is more destructive than most other malware, it’s not impossible to fight back and protect people and data alike.

“People can best protect themselves against Emotet by implementing a strong antimalware program within their secure email gateway, in conjunction with user education that reinforces the risks posed by links and attachments,” DeGrippo said.

In its alert, CISA offers several ways to counter Emotet as well as other malware. These include:

Block: Organizations should block email attachments associated with malware, such as .dll and .exe files, as well as attachments that cannot be scanned by antivirus software, such as .zip files.

Implement: Organizations should implement programs such as antivirus programs and formal patch management processes. CISA also recommends implementing a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system to cut down on spoofed emails.

Segment: Organizations should segment networks and functions to keep attacks from spreading across the network.

Limit: Finally, organizations should work to limit lateral movement throughout their network, which can reduce Emotet’s ability to move from device-to-device.

Others have found their own ways to fight back against Emotet. In August, James Quinn, an analyst with security firm Binary Defense, published a blog post that details how he found a “kill switch” in Emotet that helped reduce attacks earlier this year. That’s one of the reasons the botnet disappeared from the scene between February and late July.