Emotet is down. Its habits aren’t
Police took over Emotet’s servers last week. The tactics it made popular, like reply-chain phishing, will continue.
Last week police from several countries took control of Emotet’s infrastructure. Emotet was one of the most widespread malware services of the last years, the door that ransomware gangs paid to walk through.
Good news. But the tricks it made famous will outlive it.
The main one: reply-chain phishing. Emotet stole emails from infected companies and replied inside real conversations, with a malicious attachment. The sender was a real contact, the subject a real thread.
What still works against that:
- Be suspicious of unexpected attachments even from people you know, especially Office files asking you to “Enable Content”.
- Block macros from the internet by policy where you can.
- Block risky attachment types such as password-protected ZIPs at the mail gateway, or at least flag them.
- If a partner’s mailbox is used against you, call them. They may not know they’re infected.
Takedowns buy time. Use it to close the doors.