The Demon Emotet, Doorkeeper for Every Malware

Legend

Born in 2014 as a banking trojan, Emotet became a botnet that sold access to infected PCs to other criminals, spread mostly through macro-laden Office documents and letting in TrickBot and Ryuk. Europol called it the world's most dangerous malware when, on 27 January 2021, an international operation coordinated by Europol and Eurojust with eight countries took over its infrastructure and pushed victims an update that uninstalled it. It rose again in November 2021 with TrickBot's help, but has been almost silent since 2023.

Exorcism

Cast it out by blocking macros in Office documents from the Internet and filtering malspam attachments and links at the gateway. Segment the network and limit access to admin shares, so that if it gets in it cannot stroll from room to room.

Technical record

Also known as

Geodo, Heodo, Mealybug (operators)

Circle

Circle II · Legions (botnets) · Circle VI · Banking trojans and infostealers

First seen

2014

Status

Exorcised (International Emotet takedown (Europol/Eurojust), 2021-01-27)

Works

The Miracle of the Ladybird

Emotet began in 2014 as a banking trojan and evolved into a malware-loading botnet sold as access to other criminals, spread mostly by malicious Office documents. Europol called it the world's most dangerous malware when an international operation took over its infrastructure on 27 January 2021 and pushed an uninstall update. It re-emerged in November 2021 with TrickBot's help but has been largely quiet since 2023.