Emotet

Overview

Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observed by global cybersecurity authorities. Originally created as a modular banking trojan derived from Cridex code, its operators (tracked as Mummy Spider or TA542) transformed it into a dedicated, high-volume delivery infrastructure for second-stage payloads such as TrickBot, QakBot, Ryuk, and Conti ransomware. Emotet was pioneered for its sophisticated email thread-hijacking capabilities: upon compromising an endpoint, it harvested inboxes and automatically inserted malicious attachments (such as password-protected ZIP archives containing macro-enabled Word or Excel documents) into ongoing real-world corporate email chains. The botnet operated across separate infrastructure clusters designated as 'Epochs' (Epoch 1 through Epoch 5), using thousands of compromised WordPress sites as Tier-1 reverse proxy relays. In January 2021, a multinational law enforcement operation dubbed 'Operation Ladybird' (coordinated by Europol, the FBI, and the U.S. Department of Justice) took down its infrastructure. Although reconstructed in late 2021 using alternative encryption mechanisms (ECDH and AES-256), continuous law enforcement and defender pressure has neutralized its threat footprint.

Known aliases

Threat reports may refer to this family under multiple names:

• Emotet
• Geodo
• Heodo
• TA542

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Mummy Spider (TA542) High confidence
  Basis: Tracked as Mummy Spider by CrowdStrike and TA542 by Proofpoint. The botnet was disrupted in January 2021 through 'Operation Ladybird' coordinated by Europol, the US DOJ, and the FBI, with multiple indictments unsealed in federal courts against developers and infrastructure hosts. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Cridex

Known Derivatives & Downstream Variants: Epoch1 · Epoch2 · Epoch3 · Epoch4 · Epoch5

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-0199 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-11882 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2020-0688 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Block network destinations matching abuse.ch Feodo Tracker Emotet active C2 server lists
• Alert on non-browser HTTP POST traffic to external bare IP addresses on ports 7080, 8080, and 4143
• Inspect email gateways for weaponized password-protected ZIP archives containing VBS/WSF/OneNote dropper scripts

Sources: abuse.ch Feodo Tracker, CISA Advisory AA20-280A

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 4f9d0c67926b47d7cbbabcebda7a2d4bca458d9760ee59c438de61bc0f1ec377
• e276beae9586146c986dc574b5a266395bcfbd6aa17671060cc6c27f7f3a8b4e
• 26d7f0808cf70dc3858c8a14b532729a9debe4975765fa5062a4d3cf2305ae12

Delivery vectors

• Thread-hijacked email replies with weaponized password-protected ZIP archives
• Excel XLSM documents containing obfuscated Excel 4.0 macros
• OneNote attachments embedding embedded VBScript or PowerShell payloads

Persistence mechanisms

• Randomly named service installation in Windows Service Control Manager
• User-level Run keys in AppData/Local with randomized executable names

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• Suricata/ETPRO Emotet C2 rules
• YARA rule Emotet_v4 from CISA AA22-110A
• Sysmon Event ID 1 for randomly named binaries spawned by WINWORD.EXE or OUTLOOK.EXE

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_EMOTET_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Emotet"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "emotet" ascii wide nocase
        $s2 = "emotet" ascii wide nocase
        $s3 = "geodo" ascii wide nocase
        $s4 = "heodo" ascii wide nocase
        $s5 = "ta542" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Emotet (Loader) Execution & Triage
id: 01b04abc-ab82-59f8-abaa-e010e33bdf49
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Emotet malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/emotet
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.loader
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1566_001
- attack.t1059_001
- attack.t1071_001
- attack.t1547_001
- attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_EMOTET_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Emotet tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "emotet" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate affected host from network
2. Block known C2 IPs at perimeter
3. Reset credentials cached on the host
4. Hunt for lateral movement via SMB and WMI
5. Audit for follow-on payloads (TrickBot, Qbot, Cobalt Strike)

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the dropper without checking for secondary payloads
2. Do not re-enable macros until policy hardening is verified
3. Do not assume single-host containment; Emotet spreads laterally

References & External Analysis

• MITRE ATT&CK: Emotet (S0367)
• CISA Advisory: AA20-280A: Emotet Malware
• Search "emotet" on VirusTotal (External Analysis)
• Search "emotet" on Any.Run (Sandbox Sandbox)
• Search "emotet" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA20-280A: Emotet Malware ↗

Frequently Asked Questions

Related Threats (Category: Loader)

Explore other documented threats in the same operational category:

• Darkgate
• Smokeloader
• Bumblebee
• Gamarue
• Pikabot
• Nisloder
• Umbra
• Bazarloader

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/emotet.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.