TL;DR
Emotet was once the world's most destructive malware — a self-spreading, detection-evading threat that began as a banking trojan and evolved into a full-scale malware delivery platform. A coordinated international law enforcement operation dismantled its server infrastructure in early 2021, but the underlying code and attack model remain a blueprint for future threats. Both end users and system administrators should understand how Emotet worked and apply proactive defenses — including email hygiene, software patching, multi-factor authentication, and network monitoring — to guard against successor variants.
What is Emotet malware?
What's the world's most dangerous computer virus? Ask security experts, and most would start talking about Emotet malware.
Attackers created Emotet to steal banking data. But in time, hackers expanded their capabilities and added new features to this already lethal virus. The result was malware capable of theft on an almost-impossible-to-imagine scale.
Hackers also used Emotet to install other forms of malware, as long as someone paid them enough to do so. And Emotet spread rapidly and was almost impossible to detect.
We're talking about the Emotet virus in the past tense because an international group of programmers and law enforcement officials disrupted the scheme in early 2021.
But don't relax just yet.
Emotet has been through multiple iterations, and people have studied its format and functionality. Somewhere, a hacker is likely building a new and better version of this same threat. It's wise to know what to watch for and develop your security plans accordingly.
What is the history of Emotet malware?
In early 2020, the Cybersecurity and Infrastructure Security Agency called Emotet one of the most costly and destructive types of malware available. By that time, the virus had been in circulation for years. Government agencies were often targets, and each time the virus hit them, cleanup cost $1 million.
In its early versions, Emotet stole banking information. But later versions allowed the virus to:
- Deliver anything. In a so-called "loader" scheme, hackers could use their technology to deliver almost any kind of malware a hacker could dream up.
- Spread quickly. Email messages from infected accounts went to all addresses available. The technology also allowed hackers to use brute-force attacks to break deeper into networks, gaining control over entire systems and spreading from there.
- Evade detection. The technology was capable of understanding what kind of system was running, and it could react by protecting itself against removal or detection.
People made money off Emotet attacks, and a team of professionals administered the malware by running sophisticated servers all around the world. In 2021, officials from the Netherlands, Germany, the United Kingdom, France, the United States, and more carried out an operation to stop it.
During one exciting week, the team gained control of all the servers running Emotet attacks. In essence, officials disrupted Emotet at the source, and they made several arrests in the process.
Without servers to process data and carry out threats, the Emotet threat was effectively eliminated.
How did Emotet malware work?
In January of 2021, right before officials took servers down, Emotet represented 7 percent of all malware infections globally. Everyone was a target for Emotet attacks. If you have an active email account, the virus has likely touched you at least once.
Emotet primarily spread via email. Messages involved:
- Shipping. A message told victims about a package coming soon and told them to open an attachment to find out more.
- Bills. An email told recipients they owed money to a company, and they needed to open an attached invoice.
- Work. Emails from colleagues contained attachments that seemed like meeting notes or invitations to parties.
Anything a writer could dream up involving an attachment became an Emotet lure. Victims thought they needed to open those attachments, and when they did, the program asked them to "enable macros" to see all of the information inside.
Allowing macros meant starting the malware machine. Soon, a victim's computer began spreading similar messages to contacts. Emotet also borrowed functionality from WannaCry and other successful internet malware. Soon, it could take over entire networks, as long as one person clicked on an email attachment.
Is the Emotet virus still a risk?
The Emotet botnet as we know it was dismantled in January of 2021. Bad actors who used the attack for years are no longer able to use their servers and systems to find new victims.
But the malware still could infect your system. If a hacker can spot it and manipulate it, you could be subject to a new attack. Ensure that you update the settings on your virus scanner and check your system carefully.
How can individual users protect themselves from Emotet?
- Taking responsibility. Less than half of people think they have a role to play in stopping email attacks. In reality, every employee can run frontline defense. Don't open any email attachments that seem even slightly suspect. And never enable macros on anything you get via email.
- Patching your software. Make sure you're running the latest version of every piece of software you use.
- Asking for help. If your computer is running strangely, or you hear from coworkers and friends that you're sending strange notes, ask your IT team to help you clean up your computer.
What should system administrators do to defend against Emotet?
If you're a system administrator, you have yet more homework to do. Experts recommend:
- Blocking. Don't allow suspect email attachments to reach your servers, and keep out any attachments your antivirus software can't scan.
- Strengthening. Use filters, block suspicious Internet Protocol (IP) addresses, and limit unnecessary lateral communication. Don't allow file and printer sharing services. Enforce multi-factor authentication too.
- Monitoring. Watch what's happening on your servers, and restrict access to sites that seem risky or dangerous. Ensure that you're abreast of the latest security risks.
If you're looking for even more ways to ensure that hackers don't get into your systems, watch our webinar about broken authentication exploits.
Frequently asked questions
What made Emotet different from other types of malware?
Unlike simple viruses, Emotet evolved far beyond its original purpose as a banking trojan. It became a modular 'loader' platform that could deliver virtually any type of malware on behalf of paying hackers, spread itself automatically through email contacts, evade antivirus detection by identifying the host system, and even borrow capabilities from other successful malware like WannaCry to take over entire networks.
How did Emotet spread from one computer to another?
Emotet spread primarily through phishing emails that appeared to come from trusted contacts. These messages contained attachments disguised as shipping notices, invoices, or workplace documents. Once a victim opened the attachment and enabled macros, the malware activated and immediately began sending similar deceptive emails to all contacts in the victim's address book, while also using brute-force techniques to penetrate deeper into connected networks.
When and how was the Emotet botnet taken down?
In January 2021, a coordinated international operation involving law enforcement and cybersecurity agencies from the Netherlands, Germany, the United Kingdom, France, the United States, and other countries successfully seized control of all the servers running the Emotet infrastructure. By taking over the servers at the source, officials effectively cut off the malware's ability to process data and carry out attacks, and several arrests were made in connection with the operation.
Is Emotet still a threat after the 2021 takedown?
While the original Emotet botnet was dismantled, the underlying malware code could still be found and repurposed by other hackers. Additionally, Emotet has gone through multiple iterations over the years, meaning its architecture and methods are well-documented and could serve as a blueprint for new variants. Users and administrators are advised to keep virus scanners updated and remain vigilant.
What steps can everyday users take to protect themselves from Emotet-style attacks?
Individual users can significantly reduce their risk by refusing to open suspicious email attachments, never enabling macros on files received via email, keeping all software updated to the latest versions, and promptly contacting their IT team if their computer behaves unusually or if contacts report receiving strange messages from their account.
What additional defenses should system administrators implement against Emotet?
System administrators should block suspicious email attachments at the server level — including any attachments that antivirus software cannot scan — apply email and IP address filters, restrict unnecessary lateral network communication, disable file and printer sharing services where not needed, enforce multi-factor authentication (MFA), and continuously monitor server activity for signs of compromise while staying current on emerging security threats.
References
Alert (TA18-201A). (January 2020). Cybersecurity and Infrastructure Security Agency.
World's Most Dangerous Malware Emotet Disrupted Through Global Action. (January 2021). Europol.
Emotet Tops Malware Charts in December After Reboot. (January 2021). Info Security.
What is Emotet? And How to Guard Against this Persistent Trojan Malware. (April 2019). CSO.
Survey: Millions of Users Open Spam Emails, Click on Links. (March 2010). ZD Net.
Alert (AA20-280A). (October 2020). Cybersecurity and Infrastructure Security Agency.
