LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0367: Emotet

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.[1]

EnterpriseS0367MalwareObject v1.7Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Emotet matters because ATT&CK describes it as modular Windows malware primarily used as a downloader for other malware, with relationships spanning credential access, discovery, execution, persistence, lateral movement, command and control, exfiltration, and evasion behaviors. For leaders, the key issue is not one malware name; it is whether the organization can quickly contain a Windows intrusion that may become a platform for follow-on tooling such as TrickBot or IcedID.

Executive priority

Treat Emotet-style behavior as a resilience and incident-readiness test for Windows environments. Priority questions: do we have evidence for credential theft attempts, SMB/admin-share movement, PowerShell/WMI execution, scheduled task persistence, and web-based C2; can we isolate affected hosts quickly; and can we prove control coverage for audit and incident review? Because ATT&CK provides no official detection text for this object, leadership should ask for validated telemetry and tested response procedures rather than relying on malware-name alerts alone.

Technical view

SOC and IR teams should validate coverage against the related ATT&CK techniques rather than only static indicators. Emotet is linked to LSASS memory access, Wi-Fi and user/process/email account discovery, SMB/Windows Admin Shares, WMI, scheduled tasks, PowerShell, Windows Command Shell, Visual Basic, DLL injection, process hollowing, packed/embedded/encoded/obfuscated payloads, web-protocol C2, and exfiltration over C2. Detection engineering should correlate suspicious Windows execution chains, credential-access signals, lateral SMB activity, persistence artifacts, and unusual outbound web traffic from hosts showing discovery or injection behavior.

Likely telemetry

  • Windows process creation events with command-line detail for PowerShell, cmd, Visual Basic/script hosts, WMI, and scheduled task execution
  • Windows security and endpoint telemetry for LSASS access, credential dumping indicators, process injection, DLL injection, and process hollowing
  • Scheduled task creation, modification, and execution records
  • Service/task naming and masquerading evidence
  • SMB/admin share access, remote logons, local account use, and lateral authentication patterns

Detection direction

  • Do not depend on Emotet signatures alone; ATT&CK relationships show behaviors that can change through obfuscation, packing, embedded payloads, and command obfuscation.
  • Tune detections around behavior chains: suspicious script or shell execution followed by discovery, LSASS access, scheduled task creation, SMB movement, and outbound web traffic.
  • Validate visibility for Windows administrative features that are commonly noisy, especially WMI, PowerShell, scheduled tasks, and SMB admin shares; separate normal administration from unusual parent processes, hosts, users, timing, and destinations.
  • Review false positives from legitimate IT automation, software deployment, backup activity, helpdesk tools, and administrative scripts before escalating broad detections.
  • Use relationship context carefully: ATT&CK links Emotet to Wizard Spider and multiple techniques, but local telemetry is required to determine whether any specific incident involves this malware or actor.

Mitigation priorities

  • Prioritize Windows endpoint hardening and monitoring around script execution, WMI, scheduled tasks, and command shells.
  • Reduce credential exposure by hardening LSASS access, limiting local administrator rights, and addressing local account/password reuse risk.
  • Constrain SMB/admin-share access and monitor remote administrative activity between workstations and servers.
  • Strengthen egress monitoring and filtering for unusual web-protocol traffic from endpoints, especially when paired with discovery or persistence signals.
  • Maintain incident response playbooks for rapid host isolation, credential reset decisions, lateral movement scoping, and follow-on malware investigation.
Additional notes and limits

The most useful defensive framing is Emotet as a downloader and intrusion-enablement risk on Windows. Its ATT&CK relationships make it relevant to managed detection, IR readiness, identity protection, endpoint hardening, network monitoring, and compliance evidence for logging and response controls. The supplied object has no ATT&CK tactic list and no official detection guidance, so this take is driven by the official description, external references, and related techniques.

This summary uses only the supplied ATT&CK fields and relationships. It does not assert current activity, customer exposure, successful detection coverage, or actor attribution beyond the stated ATT&CK relationship that Wizard Spider uses this object. Platform claims are limited to the supplied Windows platform for Emotet, while related techniques may list broader platforms.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Emotet

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

47 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

Emotet has enumerated all users connected to network shares.

EnterpriseT1570Lateral Tool Transfer

Emotet has copied itself to remote systems using the `service.exe` filename.[2]

EnterpriseT1573.001Symmetric CryptographySub-technique

Emotet is known to use RSA keys for encrypting C2 traffic. [3]

EnterpriseT1552.001Credentials In FilesSub-technique

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user. [4][5]

EnterpriseT1110.001Password GuessingSub-technique

Emotet has been observed using a hard coded list of passwords to brute force user accounts. [6][7][4][8][5][2]

EnterpriseT1047Windows Management Instrumentation

Emotet has used WMI to execute powershell.exe.[9]

EnterpriseT1571Non-Standard Port

Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.[10][2]

EnterpriseT1027.001Binary PaddingSub-technique

Emotet inflates malicious files and malware as an evasion technique.[11]

EnterpriseT1218.010Regsvr32Sub-technique

Emotet uses RegSvr32 to execute the DLL payload.[11]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement. [6][2]

EnterpriseT1204.002Malicious FileSub-technique

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.[1][9][12]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

Emotet has the ability to duplicate the user’s token.[2] For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.[13]

EnterpriseT1078.003Local AccountsSub-technique

Emotet can brute force a local admin password, then use it to facilitate lateral movement.[6]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.[7][4][14]

EnterpriseT1566.002Spearphishing LinkSub-technique

Emotet has been delivered by phishing emails containing links. [1][15][16][6][7][4][10][10][14]

EnterpriseT1132.001Standard EncodingSub-technique

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server.[2] Additionally, Emotet has used Base64 to encode data before sending to the C2 server.[17]

EnterpriseT1135Network Share Discovery

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`. [2]

EnterpriseT1071.001Web ProtocolsSub-technique

Emotet has used HTTP for command and control.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Emotet has exfiltrated data over its C2 channel.[3][2]

EnterpriseT1027.009Embedded PayloadsSub-technique

Emotet has dropped an embedded executable at `%Temp%\setup.exe`.[2] Additionally, Emotet may embed entire code into other files.[13]

EnterpriseT1105Ingress Tool Transfer

Emotet can download follow-on payloads and items via malicious `url` parameters in obfuscated PowerShell code.[18]

EnterpriseT1210Exploitation of Remote Services

Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.[7][4][8][19]

EnterpriseT1114Email Collection

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.[5][12][2]

EnterpriseT1053.005Scheduled TaskSub-technique

Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.[4][13]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Emotet has been observed dropping browser password grabber modules. [3][12]

EnterpriseT1059.001PowerShellSub-technique

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz. [7][3][14][19][9]

EnterpriseT1140Deobfuscate/Decode Files or Information

Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.[2]

EnterpriseT1059.005Visual BasicSub-technique

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. [7][10][3][14][9]

EnterpriseT1204.001Malicious LinkSub-technique

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.[1][9]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.[2]

EnterpriseT1027.010Command ObfuscationSub-technique

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts. [10][3][14][22]

EnterpriseT1003.001LSASS MemorySub-technique

Emotet has been observed dropping and executing password grabber modules including Mimikatz.[3][13]

EnterpriseT1040Network Sniffing

Emotet has been observed to hook network APIs to monitor network traffic. [1]

EnterpriseT1620Reflective Code Loading

Emotet has reflectively loaded payloads into memory.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Emotet uses obfuscated URLs to download a ZIP file.[11]

EnterpriseT1059.003Windows Command ShellSub-technique

Emotet has used cmd.exe to run a PowerShell script. [14]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Emotet has been delivered by phishing emails containing attachments. [16][6][7][4][10][3][14][9][12]

EnterpriseT1087.003Email AccountSub-technique

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.[5][12][2]

EnterpriseT1027.002Software PackingSub-technique

Emotet has used custom packers to protect its payloads.[3]

EnterpriseT1055.012Process HollowingSub-technique

Emotet uses a copy of `certutil.exe` stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code.[11]

EnterpriseT1057Process Discovery

Emotet has been observed enumerating local processes.[23]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Emotet has been observed injecting in to Explorer.exe and other processes. [14][1][4]

EnterpriseT1114.001Local Email CollectionSub-technique

Emotet has been observed leveraging a module that scrapes email data from Outlook.[5]

EnterpriseT1543.003Windows ServiceSub-technique

Emotet has been observed creating new services to maintain persistence.[4][8][2]

EnterpriseT1573Encrypted Channel

Emotet has encrypted data before sending to the C2 server.[17]

EnterpriseT1106Native API

Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.[2]

EnterpriseT1016.002Wi-Fi DiscoverySub-technique

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0102: Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1110.001: Password GuessingEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1027.001: Binary PaddingEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1134.001: Token Impersonation/TheftEnterpriseuses · TechniqueT1078.003: Local AccountsEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1210: Exploitation of Remote ServicesEnterpriseuses · TechniqueT1114: Email CollectionEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.7
Created
Modified
Raw hash
7a8b5571d5e95e58...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.7Current bundle7a8b5571d5e9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  2. [2]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  3. [3]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  4. [4]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  5. [5]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  6. [6]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  7. [7]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  8. [8]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  9. [9]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  10. [10]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  11. [11]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  12. [12]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  13. [13]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  14. [14]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  15. [15]
    Kaspersky Emotet Jan 2019

    Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.

    Open source URL
  16. [16]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  17. [17]
    Fortinet Emotet May 2017

    Xiaopeng Zhang. (2017, May 3). Deep Analysis of New Emotet Variant – Part 1. Retrieved April 1, 2019.

    Open source URL
  18. [18]
    Pincus Emotet 2020

    Süleyman Özarslan, PhD; Pincus Security Inc.. (2020, July 14). An Analysis of Emotet Malware: PowerShell Unobfuscation. Retrieved November 25, 2024.

    Open source URL
  19. [19]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  20. [20]
    CrowdStrike Grim Spider May 2019

    John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.

    Open source URL
  21. [21]
    Sophos New Ryuk Attack October 2020

    Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.

    Open source URL
  22. [22]
    ESET Emotet Dec 2018

    Perez, D.. (2018, December 28). Analysis of the latest Emotet propagation campaign. Retrieved April 16, 2019.

    Open source URL
  23. [23]
    ASEC Emotet 2017

    ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.

    Open source URL
  24. [24]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  25. [25]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  26. [26]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  27. [27]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  28. [28]
    ESET Emotet Nov 2018

    ESET . (2018, November 9). Emotet launches major new spam campaign. Retrieved March 25, 2019.

    Open source URL
  29. [29]
    ESET Emotet Nov 2018

    ESET . (2018, November 9). Emotet launches major new spam campaign. Retrieved March 25, 2019.

    Open source URL
  30. [30]
    ESET Emotet Nov 2018

    ESET . (2018, November 9). Emotet launches major new spam campaign. Retrieved March 25, 2019.

    Open source URL
  31. [31]
    Emotet

    (Citation: Trend Micro Banking Malware Jan 2019)(Citation: Kaspersky Emotet Jan 2019)(Citation: CIS Emotet Apr 2017)(Citation: Malwarebytes Emotet Dec 2017)(Citation: Symantec Emotet Jul 2018)(Citation: US-CERT Emotet Jul 2018)(Citation: ESET Emotet Nov 2018)(Citation: Secureworks Emotet Nov 2018)(Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: CIS Emotet Dec 2018)(Citation: Picus Emotet Dec 2018)(Citation: Red Canary Emotet Feb 2019)

  32. [32]
    Emotet

    (Citation: Trend Micro Banking Malware Jan 2019)(Citation: Kaspersky Emotet Jan 2019)(Citation: CIS Emotet Apr 2017)(Citation: Malwarebytes Emotet Dec 2017)(Citation: Symantec Emotet Jul 2018)(Citation: US-CERT Emotet Jul 2018)(Citation: ESET Emotet Nov 2018)(Citation: Secureworks Emotet Nov 2018)(Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: CIS Emotet Dec 2018)(Citation: Picus Emotet Dec 2018)(Citation: Red Canary Emotet Feb 2019)

  33. [33]
    Emotet

    (Citation: Trend Micro Banking Malware Jan 2019)(Citation: Kaspersky Emotet Jan 2019)(Citation: CIS Emotet Apr 2017)(Citation: Malwarebytes Emotet Dec 2017)(Citation: Symantec Emotet Jul 2018)(Citation: US-CERT Emotet Jul 2018)(Citation: ESET Emotet Nov 2018)(Citation: Secureworks Emotet Nov 2018)(Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: CIS Emotet Dec 2018)(Citation: Picus Emotet Dec 2018)(Citation: Red Canary Emotet Feb 2019)

  34. [34]
    Geodo

    (Citation: Trend Micro Emotet Jan 2019)

  35. [35]
    Geodo

    (Citation: Trend Micro Emotet Jan 2019)

  36. [36]
    Geodo

    (Citation: Trend Micro Emotet Jan 2019)

  37. [37]
    Kaspersky Emotet Jan 2019

    Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.

    Open source URL
  38. [38]
    Kaspersky Emotet Jan 2019

    Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.

    Open source URL
  39. [39]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  40. [40]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  41. [41]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  42. [42]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  43. [43]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  44. [44]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  45. [45]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  46. [46]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  47. [47]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  48. [48]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  49. [49]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  50. [50]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  51. [51]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  52. [52]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  53. [53]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  54. [54]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  55. [55]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  56. [56]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  57. [57]
    mitre-attackS0367
    Open source URL
  58. [58]
    mitre-attackS0367
    Open source URL
  59. [59]
    mitre-attackS0367
    Open source URL
  60. [60]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  61. [61]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  62. [62]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  63. [63]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  64. [64]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  65. [65]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  66. [66]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  67. [67]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  68. [68]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  69. [69]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  70. [70]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  71. [71]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  72. [72]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  73. [73]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  74. [74]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  75. [75]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  76. [76]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  77. [77]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  78. [78]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  79. [79]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  80. [80]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  81. [81]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  82. [82]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  83. [83]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  84. [84]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  85. [85]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  86. [86]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  87. [87]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  88. [88]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  89. [89]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  90. [90]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  91. [91]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  92. [92]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  93. [93]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  94. [94]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  95. [95]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  96. [96]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  97. [97]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  98. [98]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  99. [99]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  100. [100]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  101. [101]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  102. [102]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  103. [103]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  104. [104]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  105. [105]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  106. [106]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  107. [107]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  108. [108]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  109. [109]
    Kaspersky Emotet Jan 2019

    Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.

    Open source URL
  110. [110]
    Kaspersky Emotet Jan 2019

    Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.

    Open source URL
  111. [111]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  112. [112]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  113. [113]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  114. [114]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  115. [115]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  116. [116]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  117. [117]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  118. [118]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  119. [119]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  120. [120]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  121. [121]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  122. [122]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  123. [123]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  124. [124]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  125. [125]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  126. [126]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  127. [127]
    Fortinet Emotet May 2017

    Xiaopeng Zhang. (2017, May 3). Deep Analysis of New Emotet Variant – Part 1. Retrieved April 1, 2019.

    Open source URL
  128. [128]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  129. [129]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  130. [130]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  131. [131]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  132. [132]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  133. [133]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  134. [134]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  135. [135]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  136. [136]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  137. [137]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  138. [138]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  139. [139]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  140. [140]
    Pincus Emotet 2020

    Süleyman Özarslan, PhD; Pincus Security Inc.. (2020, July 14). An Analysis of Emotet Malware: PowerShell Unobfuscation. Retrieved November 25, 2024.

    Open source URL
  141. [141]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  142. [142]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  143. [143]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  144. [144]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  145. [145]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  146. [146]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  147. [147]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  148. [148]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  149. [149]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  150. [150]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  151. [151]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  152. [152]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  153. [153]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  154. [154]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  155. [155]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  156. [156]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  157. [157]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  158. [158]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  159. [159]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  160. [160]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  161. [161]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  162. [162]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  163. [163]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  164. [164]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  165. [165]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  166. [166]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  167. [167]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  168. [168]
    Red Canary Emotet Feb 2019

    Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.

    Open source URL
  169. [169]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  170. [170]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  171. [171]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  172. [172]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  173. [173]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  174. [174]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  175. [175]
    CrowdStrike Grim Spider May 2019

    John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.

    Open source URL
  176. [176]
    Sophos New Ryuk Attack October 2020

    Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.

    Open source URL
  177. [177]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  178. [178]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  179. [179]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  180. [180]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  181. [181]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  182. [182]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  183. [183]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  184. [184]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  185. [185]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  186. [186]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  187. [187]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  188. [188]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  189. [189]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  190. [190]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  191. [191]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  192. [192]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  193. [193]
    ESET Emotet Dec 2018

    Perez, D.. (2018, December 28). Analysis of the latest Emotet propagation campaign. Retrieved April 16, 2019.

    Open source URL
  194. [194]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  195. [195]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  196. [196]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  197. [197]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  198. [198]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  199. [199]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  200. [200]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  201. [201]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  202. [202]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  203. [203]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  204. [204]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  205. [205]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  206. [206]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  207. [207]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  208. [208]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  209. [209]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  210. [210]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  211. [211]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  212. [212]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  213. [213]
    CIS Emotet Apr 2017

    CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.

    Open source URL
  214. [214]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  215. [215]
    Carbon Black Emotet Apr 2019

    Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019.

    Open source URL
  216. [216]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  217. [217]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  218. [218]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  219. [219]
    Malwarebytes Emotet Dec 2017

    Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.

    Open source URL
  220. [220]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  221. [221]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  222. [222]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  223. [223]
    Symantec Emotet Jul 2018

    Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.

    Open source URL
  224. [224]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  225. [225]
    Talos Emotet Jan 2019

    Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.

    Open source URL
  226. [226]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  227. [227]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  228. [228]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  229. [229]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  230. [230]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  231. [231]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  232. [232]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  233. [233]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  234. [234]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  235. [235]
    IBM IcedID November 2017

    Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.

    Open source URL
  236. [236]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  237. [237]
    Trend Micro Emotet Jan 2019

    Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.

    Open source URL
  238. [238]
    emotet_trendmicro_mar2023

    Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024.

    Open source URL
  239. [239]
    Picus Emotet Dec 2018

    Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.

    Open source URL
  240. [240]
    Trend Micro Banking Malware Jan 2019

    Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.

    Open source URL
  241. [241]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  242. [242]
    CIS Emotet Dec 2018

    CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.

    Open source URL
  243. [243]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  244. [244]
    Secureworks Emotet Nov 2018

    Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.

    Open source URL
  245. [245]
    US-CERT Emotet Jul 2018

    US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.

    Open source URL
  246. [246]
    Fortinet Emotet May 2017

    Xiaopeng Zhang. (2017, May 3). Deep Analysis of New Emotet Variant – Part 1. Retrieved April 1, 2019.

    Open source URL
  247. [247]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  248. [248]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use