Emotet: The world's most dangerous malware botnet was just disrupted by a major police operation

Europol and FBI among agencies that have taken control of the botnet infrastructure used by cybercriminals behind some of the most prolific malware and ransomware attacks. A week of action by law enforcement agencies around the world gained control of Emotet's infrastructure of hundreds of servers around the world and disrupted it from the inside.

Machines infected by Emotet are now directed to infrastructure controlled by law enforcement, meaning cyber criminals can no longer exploit machines compromised and the malware can no longer spread to new targets, something which will cause significant disruption to cyber-criminal operations.

How Hackers Exploit Brand Names 

The world's most prolific and dangerous malware botnet has been taken down following a global law enforcement operation that was two years in the planning.

Europol, the FBI, the UK's National Crime Agency, and others coordinated action which has resulted in investigators taking control of the infrastructure controlling Emotet in one of the most significant disruptions of cyber-criminal operations in recent years.

Emotet first emerged as a banking trojan in 2014 but evolved into one of the most powerful forms of malware used by cybercriminals.

Emotet establishes a backdoor onto Windows computer systems via automated phishing emails that distribute Word documents compromised with malware. Subjects of emails and documents in Emotet campaigns are regularly altered to provide the best chance of luring victims into opening emails and installing malware – regular themes include invoices, shipping notices, and information about COVID-19.

Those behind the Emotet lease their army of infected machines out to other cybercriminals as a gateway for additional malware attacks, including remote access tools (RATs) and ransomware.

It resulted in Emotet becoming what Europol describes as "the world's most dangerous malware" and "one of the most significant botnets of the past decade", with operations like Ryuk ransomware and TrickBot banking trojan hiring access to machines compromised by Emotet in order to install their own malware.

Emotet allowed hackers and cybercriminals to distribute their own brand of malware and/or viruses using leased software to distribute their bits of code to victims around the world. One group alone, Ryuk earned over 150 million dollars and was able to hide their theft using cryptocurrency. Most of the Ryuk gang's "earnings" are being cashed out through accounts at crypto-exchanges Binance and Huobi. The victim(s) are instructed to make payment using a cryptocurrency such as ethereum or bitcoin.

Who runs some security software companies?  Not surprisingly former convicted are sent to prison and given a sentence which may include a requirement of working for the FBI or some other security firm. Such is the story of Kevin Mitnick. (hire a criminal to catch a criminal)

Emotet: