MUMMY SPIDER

Also known as: ATK 104, ATK104, GOLD CRESTWOOD, Gold Crestwood, MUMMY SPIDER, Mealybug, Mummy Spider, TA542, UNC3443, White Taranis

MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo. First observed in mid-2014, this malware shared code with the Bugat (aka Feodo) banking Trojan. However, MUMMY SPIDER swiftly developed the malware’s capabilities to include an RSA key exchange for command and control (C2) communication and a modular architecture. MUMMY SPIDER does not follow typical criminal behavioral patterns. In particular, MUMMY SPIDER usually conducts attacks for a few months before ceasing operations for a period of between three and 12 months, before returning with a new variant or version. After a 10 month hiatus, MUMMY SPIDER returned Emotet to operation in December 2016 but the latest variant is not deploying a banking Trojan module with web injects, it is currently acting as a ‘loader’ delivering other malware packages. The primary modules perform reconnaissance on victim machines, drop freeware tools for credential collection from web browsers and mail clients and a spam plugin for self-propagation. The malware is also issuing commands to download and execute other malware families such as the banking Trojans Dridex and Qakbot. MUMMY SPIDER advertised Emotet on underground forums until 2015, at which time it became private. Therefore, it is highly likely that Emotet is operate

🌍 Country ["[Unknown]"]

Associated Operations

2017-08 2018 2018-10 2018-11 2019 2019-01 2019-04 2019-09 2019-12 2020 2020-01 2020-02 2020-03 2020-06 2020-07 2020-08 2020-10 2020-12 2021-11 2021-12 2022-01 2022-02 2022-03 2022-04 2022-06 2022-11 According to our telemetry Back From the Dead Beginning the morning of April 9th Between January 1 CISA and MS-ISAC have seen a significant increase in malicious cyber actors targeting state and local governments with Emotet phishing emails. EMOTET Uses Corona Virus Outbreak in New Spam Campaign EMOTET now has a wider scope. Emotet Awakens With New Campaign of Mass Email Exfiltration Emotet Evolves With new Wi-Fi Spreader Emotet Returns in 2022 Emotet SMiShing Uses Fake Bank Domains in Targeted Attacks Emotet Spam Abuses Unconventional IP Address Formats to Spread Malware Emotet Spoofs IRS in Tax Season-Themed Phishing Email Campaign Emotet Targeting Japanese Organizations Emotet Tests New Delivery Techniques Emotet Wi-Fi Spreader Upgraded Emotet botnet starts blasting malware again after 4 month break Emotet botnet switches to 64-bit modules Emotet is back after a summer break Emotet malware hits Lithuania's National Public Health Center Emotet malware infects users again after fixing broken installer Emotet malware is back and rebuilding its botnet via TrickBot Emotet malware now installs via PowerShell in Windows shortcut files Emotet malware now steals credit cards from Google Chrome users Emotet malware now steals your email attachments to attack contacts Emotet malware strikes U.S. businesses with COVID-19 spam Emotet modules and recent attacks Emotet now drops Cobalt Strike Emotet strikes Quebec’s Department of Justice Germany It was never a question of “if” but “when”. After five months of absence New Emotet Infection Method New Emotet attacks use fake Windows Update lures On October 1 Payloads Hint at TrickBot Connection Pretending to be the Permanent Mission of Norway Researchers tracking Emotet botnet noticed that the malware started to push QakBot banking trojan at an unusually high rate Secret Service Investigates Breach at U.S. Govt IT Contractor Since August The city of Frankfurt Threat actor group TA542 While the earlier variants of EMOTET primarily targeted the banking sector a city in southwest Germany. a spam campaign was first spotted on July 13 showing signs of a likely comeback. a town and a city north of Frankfurt and healthcare. Again as seen in our telemetry data. as there were also incidents that occurred in Gießen and Bad Homburg as well as in Freiburg became the latest victim of Emotet after an infection forced it to close its IT network. But the financial center wasn’t the only area that was targeted by Emotet fast forwards ransomware attacks following a period of low activity. Figure 1 shows a spike in the Emotet detection rate in the beginning of November 2018 food and beverage https://blog.malwarebytes.com/trojans/2020/07/long-dreaded-emotet-has-returned/ https://blog.talosintelligence.com/2019/09/emotet-is-back-after-summer-break.html https://blog.talosintelligence.com/2020/01/stolen-emails-reflect-emotets-organic.html https://blog.talosintelligence.com/emotet-coming-in-hot/ https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ https://cofense.com/blog/emotet-spoofs-irs-in-tax-season/ https://cofense.com/emotet-gang-switches-highly-customized-templates-utilizing-stolen-email-content-victims/ https://krebsonsecurity.com/2019/09/secret-service-investigates-breach-at-u-s-govt-it-contractor/ https://securelist.com/emotet-modules-and-recent-attacks/106290/ https://securityintelligence.com/posts/emotet-smishing-uses-fake-bank-domains-in-targeted-attacks-payloads-hint-at-trickbot-connection/ https://threatpost.com/emotet-resurgence-continues-with-new-tactics-techniques-and-procedures/149914/ https://unit42.paloaltonetworks.com/new-emotet-infection-method/ https://us-cert.cisa.gov/ncas/alerts/aa20-280a https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/ https://www.binarydefense.com/emotet-wi-fi-spreader-upgraded/ https://www.bleepingcomputer.com/news/security/emotet-botnet-is-now-heavily-spreading-qakbot-malware/ https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-again-after-4-month-break/ https://www.bleepingcomputer.com/news/security/emotet-botnet-switches-to-64-bit-modules-increases-activity/ https://www.bleepingcomputer.com/news/security/emotet-malware-hits-lithuanias-national-public-health-center/ https://www.bleepingcomputer.com/news/security/emotet-malware-infects-users-again-after-fixing-broken-installer/ https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/ https://www.bleepingcomputer.com/news/security/emotet-malware-now-installs-via-powershell-in-windows-shortcut-files/ https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-credit-cards-from-google-chrome-users/ https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-your-email-attachments-to-attack-contacts/ https://www.bleepingcomputer.com/news/security/emotet-malware-strikes-us-businesses-with-covid-19-spam/ https://www.bleepingcomputer.com/news/security/emotet-now-drops-cobalt-strike-fast-forwards-ransomware-attacks/ https://www.bleepingcomputer.com/news/security/united-nations-targeted-with-emotet-malware-phishing-attack/ https://www.cybereason.com/blog/research/threat-alert-emotet-targeting-japanese-organizations https://www.deepinstinct.com/blog/emotet-malware-returns-in-2022 https://www.kryptoslogic.com/blog/2018/10/emotet-awakens-with-new-campaign-of-mass-email-exfiltration/ https://www.proofpoint.com/us/blog/threat-insight/emotet-makes-timely-adoption-political-and-elections-lures https://www.proofpoint.com/us/blog/threat-insight/emotet-tests-new-delivery-techniques https://www.proofpoint.com/us/corporate-blog/post/emotet-returns-after-holiday-break-major-campaigns https://www.proofpoint.com/us/threat-insight/post/beyond-north-america-threat-actors-target-canada-specifically https://www.trendmicro.com/en_us/research/22/a/emotet-spam-abuses-unconventional-ip-address-formats-spread-malware.html https://www.trendmicro.com/vinfo/th/threat-encyclopedia/spam/3682/emotet-uses-corona-virus-outbreak-in-new-spam-campaign https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/emotet-attack-causes-shutdown-of-frankfurt-s-it-network https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/ https://www.welivesecurity.com/2018/12/28/analysis-latest-emotet-propagation-campaign/ https://www.welivesecurity.com/2020/09/16/emotet-quebec-department-justice-eset/ https://www.zdnet.com/article/new-emotet-attacks-use-fake-windows-update-lures/ hundreds of which were sent to Canadian organizations. While discussions of threats in this region often focus on “North America” generally or just the United States including manufacturing increases activity is back from their Christmas holiday. Based on past activity and what we’re seeing in just three days it is possible that due to the nature of its distribution nearly 100 campaigns during this period were either specifically targeted at Canadian organizations or were customized for Canadian audiences. one of the world’s most disruptive threats is back to work and everyone around the world should take note and implement steps to protect themselves. our Smart Protection Network (SPN) data reveals that this time replacing the longtime TrickBot payload. respectively the Emotet gang began utilizing what appears to be the stolen emails of their victims. It was noted back in October of 2018 that a new module was added that could steal the email content on a victim’s machine. the Emotet operators performed a targeted phishing attack against email addresses associated with users at the United Nations. the dreaded Emotet has returned. Following several false alarms over the last few weeks the group that’s behind Emotet the latest Emotet activity was launched on November 5 the malware isn’t being picky about the industries it chooses to attack. The affected companies come from different industries threat actors conducted thousands of malicious email campaigns to May 1 we observed thousands of Emotet email messages with the subject “Team Blue Take Action” sent to hundreds of organizations in the US. The message body is taken directly from a page on the Democratic National Committee's website with the addition of a line requesting that the recipient open the attached document.

Introduction

MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo. First observed in mid-2014, this malware shared code with the Bugat (aka Feodo) banking Trojan. However, MUMMY SPIDER swiftly developed the malware’s capabilities to include an RSA key exchange for command and control (C2) communication and a modular architecture. MUMMY SPIDER does not follow typical criminal behavioral patterns. In particular, MUMMY SPIDER usually conducts attacks for a few months before ceasing operations for a period of between three and 12 months, before returning with a new variant or version. After a 10 month hiatus, MUMMY SPIDER returned Emotet to operation in December 2016 but the latest variant is not deploying a banking Trojan module with web injects, it is currently acting as a ‘loader’ delivering other malware packages. The primary modules perform reconnaissance on victim machines, drop freeware tools for credential collection from web browsers and mail clients and a spam plugin for self-propagation. The malware is also issuing commands to download and execute other malware families such as the banking Trojans Dridex and Qakbot. MUMMY SPIDER advertised Emotet on underground forums until 2015, at which time it became private. Therefore, it is highly likely that Emotet is operate

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2017-08
  • 2018
  • 2018-10
  • 2018-11
  • 2019
  • 2019-01
  • 2019-04
  • 2019-09
  • 2019-12
  • 2020
  • 2020-01
  • 2020-02
  • 2020-03
  • 2020-06
  • 2020-07
  • 2020-08
  • 2020-10
  • 2020-12
  • 2021-11
  • 2021-12
  • 2022-01
  • 2022-02
  • 2022-03
  • 2022-04
  • 2022-06
  • 2022-11
  • According to our telemetry
  • Back From the Dead
  • Beginning the morning of April 9th
  • Between January 1
  • CISA and MS-ISAC have seen a significant increase in malicious cyber actors targeting state and local governments with Emotet phishing emails.
  • EMOTET Uses Corona Virus Outbreak in New Spam Campaign
  • EMOTET now has a wider scope.
  • Emotet Awakens With New Campaign of Mass Email Exfiltration
  • Emotet Evolves With new Wi-Fi Spreader
  • Emotet Returns in 2022
  • Emotet SMiShing Uses Fake Bank Domains in Targeted Attacks
  • Emotet Spam Abuses Unconventional IP Address Formats to Spread Malware
  • Emotet Spoofs IRS in Tax Season-Themed Phishing Email Campaign
  • Emotet Targeting Japanese Organizations
  • Emotet Tests New Delivery Techniques
  • Emotet Wi-Fi Spreader Upgraded
  • Emotet botnet starts blasting malware again after 4 month break
  • Emotet botnet switches to 64-bit modules
  • Emotet is back after a summer break
  • Emotet malware hits Lithuania’s National Public Health Center
  • Emotet malware infects users again after fixing broken installer
  • Emotet malware is back and rebuilding its botnet via TrickBot
  • Emotet malware now installs via PowerShell in Windows shortcut files
  • Emotet malware now steals credit cards from Google Chrome users
  • Emotet malware now steals your email attachments to attack contacts
  • Emotet malware strikes U.S. businesses with COVID-19 spam
  • Emotet modules and recent attacks
  • Emotet now drops Cobalt Strike
  • Emotet strikes Quebec’s Department of Justice
  • Germany
  • It was never a question of “if” but “when”. After five months of absence
  • New Emotet Infection Method
  • New Emotet attacks use fake Windows Update lures
  • On October 1
  • Payloads Hint at TrickBot Connection
  • Pretending to be the Permanent Mission of Norway
  • Researchers tracking Emotet botnet noticed that the malware started to push QakBot banking trojan at an unusually high rate
  • Secret Service Investigates Breach at U.S. Govt IT Contractor
  • Since August
  • The city of Frankfurt
  • Threat actor group TA542
  • While the earlier variants of EMOTET primarily targeted the banking sector
  • a city in southwest Germany.
  • a spam campaign was first spotted on July 13 showing signs of a likely comeback.
  • a town and a city north of Frankfurt
  • and healthcare. Again
  • as seen in our telemetry data.
  • as there were also incidents that occurred in Gießen and Bad Homburg
  • as well as in Freiburg
  • became the latest victim of Emotet after an infection forced it to close its IT network. But the financial center wasn’t the only area that was targeted by Emotet
  • fast forwards ransomware attacks
  • following a period of low activity. Figure 1 shows a spike in the Emotet detection rate in the beginning of November 2018
  • food and beverage
  • https://blog.malwarebytes.com/trojans/2020/07/long-dreaded-emotet-has-returned/
  • https://blog.talosintelligence.com/2019/09/emotet-is-back-after-summer-break.html
  • https://blog.talosintelligence.com/2020/01/stolen-emails-reflect-emotets-organic.html
  • https://blog.talosintelligence.com/emotet-coming-in-hot/
  • https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/
  • https://cofense.com/blog/emotet-spoofs-irs-in-tax-season/
  • https://cofense.com/emotet-gang-switches-highly-customized-templates-utilizing-stolen-email-content-victims/
  • https://krebsonsecurity.com/2019/09/secret-service-investigates-breach-at-u-s-govt-it-contractor/
  • https://securelist.com/emotet-modules-and-recent-attacks/106290/
  • https://securityintelligence.com/posts/emotet-smishing-uses-fake-bank-domains-in-targeted-attacks-payloads-hint-at-trickbot-connection/
  • https://threatpost.com/emotet-resurgence-continues-with-new-tactics-techniques-and-procedures/149914/
  • https://unit42.paloaltonetworks.com/new-emotet-infection-method/
  • https://us-cert.cisa.gov/ncas/alerts/aa20-280a
  • https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/
  • https://www.binarydefense.com/emotet-wi-fi-spreader-upgraded/
  • https://www.bleepingcomputer.com/news/security/emotet-botnet-is-now-heavily-spreading-qakbot-malware/
  • https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-again-after-4-month-break/
  • https://www.bleepingcomputer.com/news/security/emotet-botnet-switches-to-64-bit-modules-increases-activity/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-hits-lithuanias-national-public-health-center/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-infects-users-again-after-fixing-broken-installer/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-now-installs-via-powershell-in-windows-shortcut-files/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-credit-cards-from-google-chrome-users/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-your-email-attachments-to-attack-contacts/
  • https://www.bleepingcomputer.com/news/security/emotet-malware-strikes-us-businesses-with-covid-19-spam/
  • https://www.bleepingcomputer.com/news/security/emotet-now-drops-cobalt-strike-fast-forwards-ransomware-attacks/
  • https://www.bleepingcomputer.com/news/security/united-nations-targeted-with-emotet-malware-phishing-attack/
  • https://www.cybereason.com/blog/research/threat-alert-emotet-targeting-japanese-organizations
  • https://www.deepinstinct.com/blog/emotet-malware-returns-in-2022
  • https://www.kryptoslogic.com/blog/2018/10/emotet-awakens-with-new-campaign-of-mass-email-exfiltration/
  • https://www.proofpoint.com/us/blog/threat-insight/emotet-makes-timely-adoption-political-and-elections-lures
  • https://www.proofpoint.com/us/blog/threat-insight/emotet-tests-new-delivery-techniques
  • https://www.proofpoint.com/us/corporate-blog/post/emotet-returns-after-holiday-break-major-campaigns
  • https://www.proofpoint.com/us/threat-insight/post/beyond-north-america-threat-actors-target-canada-specifically
  • https://www.trendmicro.com/en_us/research/22/a/emotet-spam-abuses-unconventional-ip-address-formats-spread-malware.html
  • https://www.trendmicro.com/vinfo/th/threat-encyclopedia/spam/3682/emotet-uses-corona-virus-outbreak-in-new-spam-campaign
  • https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/emotet-attack-causes-shutdown-of-frankfurt-s-it-network
  • https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/
  • https://www.welivesecurity.com/2018/12/28/analysis-latest-emotet-propagation-campaign/
  • https://www.welivesecurity.com/2020/09/16/emotet-quebec-department-justice-eset/
  • https://www.zdnet.com/article/new-emotet-attacks-use-fake-windows-update-lures/
  • hundreds of which were sent to Canadian organizations. While discussions of threats in this region often focus on “North America” generally or just the United States
  • including manufacturing
  • increases activity
  • is back from their Christmas holiday. Based on past activity and what we’re seeing in just three days
  • it is possible that due to the nature of its distribution
  • nearly 100 campaigns during this period were either specifically targeted at Canadian organizations or were customized for Canadian audiences.
  • one of the world’s most disruptive threats is back to work and everyone around the world should take note and implement steps to protect themselves.
  • our Smart Protection Network (SPN) data reveals that this time
  • replacing the longtime TrickBot payload.
  • respectively
  • the Emotet gang began utilizing what appears to be the stolen emails of their victims. It was noted back in October of 2018 that a new module was added that could steal the email content on a victim’s machine.
  • the Emotet operators performed a targeted phishing attack against email addresses associated with users at the United Nations.
  • the dreaded Emotet has returned. Following several false alarms over the last few weeks
  • the group that’s behind Emotet
  • the latest Emotet activity was launched on November 5
  • the malware isn’t being picky about the industries it chooses to attack. The affected companies come from different industries
  • threat actors conducted thousands of malicious email campaigns
  • to May 1
  • we observed thousands of Emotet email messages with the subject “Team Blue Take Action” sent to hundreds of organizations in the US. The message body is taken directly from a page on the Democratic National Committee’s website
  • with the addition of a line requesting that the recipient open the attached document.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Trojan.Karagany
  • TURNEDUP
  • Trojan.Mebromi
  • ClientMesh
  • Client Maximus
  • Emotet:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.