Emotet
Emotet is a malware strain and cybercrime operation, also known as Heodo and sometimes referred to as Mealybug in the provided content. It is believed to be based in Ukraine. First detected in 2014 as a banking trojan, it later evolved into a modular loader and malware-as-a-service/crimeware operation that sold or rented access to infected systems to other criminal groups. The content states Emotet has delivered additional payloads including TrickBot and Ryuk-associated malware, and that as of September 2019 it operated three botnets: Epoch 1, Epoch 2, and Epoch 3. The operation primarily spread through malicious email campaigns, including infected attachments, links, malicious Word documents, and macro-enabled Office files. The content specifically notes use of malspam, thread hijacking using stolen emails, and lures such as invoices, shipping notices, and COVID-19-related messages. It also states Emotet adopted HTML smuggling after traditional macro-based delivery became easier to detect at the perimeter. Reported delivery changes in later campaigns included XLS attachments in 2022, oversized Word documents in March 2023 that used binary padding and hidden text to evade detection, and late-2023 abuse of a Windows App Installer-related technique via phishing attachments. Techniques and behaviors directly mentioned in the content include polymorphic code, fileless persistence via PowerShell, lateral movement within networks, and lateral movement via nearby Wi‑Fi networks. Emotet is described as an initial access platform whose operators rented compromised machines to other cybercriminals, including ransomware operators. The content also notes widespread global targeting, with significant activity against organizations and government entities, and cites over 16,000 Emotet-related alerts across U.S. federal networks between July and October 2020. In January 2021, an international law-enforcement operation coordinated by Europol and Eurojust disrupted Emotet by taking control of its infrastructure and redirecting infected machines to law-enforcement-controlled systems. The participating countries listed in the content include the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada, and Ukraine, and the action was reported as accompanied by arrests in Ukraine. The content states Emotet later resurfaced, including late-2021 samples using elliptic-curve cryptography for C2 communications.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adopted HTML smuggling as an alternative delivery method when macro-based delivery became less effective.
Referenced as a prior malware distribution group known for using stolen email threads (thread hijacking) to increase phishing legitimacy.
Operated a major botnet/loader service that distributed malware via malicious email attachments and Word documents, then sold access to other criminal groups for follow-on data theft and ransomware deployment.
Cybercrime operation running a large botnet/loader ecosystem: initial access via malspam and macro-laden Office attachments with email thread hijacking; establishes persistence/evasion (polymorphic code, fileless PowerShell), then downloads/installs secondary payloads and rents access to other criminal operations (including ransomware affiliates).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.