Emotet's comeback is getting a boost from fellow botnet TrickBot

The two botnets spell trouble for 2022, researchers say.

The resurgence of the botnet Emotet after a law enforcement takedown earlier this year is getting a boost from fellow crime group TrickBot, researchers at Check Point have found.

Since November, Check Point has identified 113 new Emotet targets in the first week of December, nearly half its infection right before it was taken down.

Emotet attempted to infect 657 new organizations (219 per week) during January 2020. And it was already at 113 new targets in the first week of December 2020. This means that in 3 weeks since its comeback, Emotet already gained 50% of its infection rate before it was taken down.

The samples of the Emotet malware are being delivered via servers that TrickBot infected in mid-November. A number of other researchers have confirmed Emotet’s return and have observed TrickBot distributing the malware.

Emotet received a series of debilitating blows last year at the hands of law enforcement. In January, U.S. and European authorities took control of the botnet’s network of infected computers and arrested several of its operators. Authorities followed that January takedown with an operation to corrupt the malware in April. Emotet essentially disappeared off the map at that point.

TrickBot also suffered a blow ahead of the 2020 U.S. election. Both Microsoft and U.S. Cyber Command launched separate operations to disrupt TrickBot’s network. But unlike Emotet, TrickBot rebounded quickly. Since TrickBot’s takedown, Check Point has identified 140,000 victims across 149 countries. The majority of TrickBot’s victims are focused in Portugal and the United States. TrickBot has also been tied to other major malware families including Ryuk and Conti ransomware.

Emotet has piggybacked off that growing network for its own rapid ascent. Both groups are well known with renting out their infrastructure to ransomware groups, a bad sign for the state of ransomware in 2022.

“Emotet is our best indicator for future ransomware attacks. We should treat Emotet and Trickbot infections like they are ransomware,” Lotem Finkelstein, head of threat intelligence at Check Point Software said in a statement. “Otherwise, it is only a matter of time before we have to deal with an actual ransomware attack.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure