{
  "family": "emotet",
  "sample_count": 12943,
  "category": "loader",
  "description": "Emotet is a modular malware family that, per MITRE ATT&CK, is primarily used as a downloader for other malware such as TrickBot and IcedID. It first emerged in June 2014, initially targeting the financial sector, and later expanded to many other industries. Although it began as a banking trojan, it became best known as a 'loader' that establishes a foothold and then pulls in additional payloads. Its operators were known for hijacking real email threads to make malicious messages look trustworthy. An international law-enforcement action disrupted its infrastructure in early 2021, though activity has been observed at times since.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Emotet",
    "Geodo"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "Is Emotet a virus, a banking trojan, or a loader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It started in 2014 as a banking trojan but is best described today as a modular loader/downloader: once it infects a system it downloads and installs other malware. MITRE ATT&CK classifies it primarily as a downloader."
      }
    },
    {
      "@type": "Question",
      "name": "What other malware does Emotet install?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE documents Emotet as a downloader for families such as TrickBot and IcedID, which in turn have been linked to ransomware operations."
      }
    },
    {
      "@type": "Question",
      "name": "When did Emotet first appear?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "June 2014, initially focused on the financial sector before expanding to multiple industries."
      }
    },
    {
      "@type": "Question",
      "name": "How does Emotet usually reach a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mainly through phishing emails carrying malicious attachments or links, often by replying within genuine, previously-stolen email threads so the message looks legitimate."
      }
    },
    {
      "@type": "Question",
      "name": "Why is thread-hijacking dangerous?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because the malicious email appears as a reply in a real conversation you recognize, it bypasses the usual 'unknown sender' suspicion."
      }
    },
    {
      "@type": "Question",
      "name": "Was Emotet ever taken down?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. A coordinated international law-enforcement operation disrupted Emotet's infrastructure in January 2021. Activity has been reported at various points afterward, so treat it as a continuing risk and follow current advisories."
      }
    },
    {
      "@type": "Question",
      "name": "How can I reduce the risk from Emotet-style threats?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Be cautious with email attachments even from known contacts, disable Office macros from untrusted sources, keep systems patched, and use reputable endpoint protection. If a work device may be affected, contact your IT/security team rather than acting alone."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read the authoritative technical details?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's Emotet entry (S0367) documents its observed techniques and links to vendor reporting; it is linked from this page."
      }
    }
  ],
  "faq_count": 8,
  "mitre_attack": [
    "T1566.001",
    "T1059.001",
    "T1071.001",
    "T1547.001",
    "T1055"
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/alerts/2020/10/06/emotet-malware",
  "last_updated": "2026-06-09",
  "overview_short": "Emotet is a modular banking trojan turned malware-as-a-service loader, historically used to drop TrickBot, Qbot, and ransomware. Operated by TA542 and disrupted by international law enforcement in January 2021, it resurfaced and remains a major threat.",
  "first_seen": "2014",
  "status": "active_resurged",
  "iocs": {
    "delivery": [
      "Macro-enabled Office documents",
      "OneNote attachments",
      "Password-protected ZIPs in phishing reply-chain emails"
    ],
    "network": [
      "HTTP POST to C2 with cookie-style payload",
      "Tier-1 C2 over ports 80/443/8080"
    ],
    "persistence": [
      "Registry Run keys",
      "Scheduled tasks",
      "Service installation under randomized name"
    ]
  },
  "detection": [
    "Suricata/ETPRO Emotet C2 rules",
    "YARA rule Emotet_v4 from CISA AA22-110A",
    "Sysmon Event ID 1 for randomly named binaries spawned by WINWORD.EXE or OUTLOOK.EXE"
  ],
  "containment_steps": [
    "Isolate affected host from network",
    "Block known C2 IPs at perimeter",
    "Reset credentials cached on the host",
    "Hunt for lateral movement via SMB and WMI",
    "Audit for follow-on payloads (TrickBot, Qbot, Cobalt Strike)"
  ],
  "what_to_avoid": [
    "Do not simply delete the dropper without checking for secondary payloads",
    "Do not re-enable macros until policy hardening is verified",
    "Do not assume single-host containment; Emotet spreads laterally"
  ],
  "references": [
    {
      "title": "CISA Alert AA22-110A: Emotet Malware",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a"
    },
    {
      "title": "Europol: World's most dangerous malware EMOTET disrupted",
      "url": "https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment"
    },
    {
      "id": "T1059.005",
      "name": "Visual Basic"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols"
    }
  ],
  "sources": [
    {
      "name": "MITRE ATT&CK: Emotet (S0367)",
      "url": "https://attack.mitre.org/software/S0367"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0367",
  "threat_actors": [
    "Mummy Spider (TA542)"
  ],
  "target_industries": [
    "Financial Services",
    "Enterprise"
  ],
  "target_geographies": [
    "Global"
  ],
  "motivation": "Financial Extortion"
}