Emotet showed the security industry what a malware distribution business looks like: one infected inbox, a worm-like spread across file shares, then TrickBot, QakBot or ransomware sold on top. This guide profiles Emotet (also tracked as Geodo) for defenders, covering its origins as a banking trojan, how it spread through stolen email threads and weak administrator passwords, the January 2021 international disruption, and the detection and hardening steps that still apply to every loader that copied it. It is aimed at SOC analysts, incident responders and endpoint and email security owners. For the general pattern of loaders, see the Malware Loaders and Droppers Guide; this page stays with Emotet's own history and behaviour.
Key takeaways
- The canonical loader botnet. MITRE ATT&CK describes Emotet (S0367) as modular malware used mainly as a downloader for families such as TrickBot and IcedID, first seen in June 2014 against the financial sector before spreading across sectors.
- Email theft fuelled its own spread. CISA alert TA18-201A describes an Outlook scraper and credential modules that harvested contacts and passwords, which were reused to send new malspam that looked like real correspondence.
- Weak admin passwords made it a network worm. Emotet enumerated writable SMB shares and brute-forced accounts, including administrator accounts, which CISA warns can infect entire domains.
- The 2021 disruption was a model for later takedowns. DOJ states law enforcement replaced Emotet files on servers so infected computers downloaded a law enforcement file that cut them off from the operators, after identifying about 1.6 million infected computers.
- The defences are unglamorous and effective. Block client-to-client SMB, use unique local administrator passwords, block risky attachment types and internet macros, and reimage rather than clean.
Who they are (names and aliases)
Emotet was run as a service: one operator group built and maintained the botnet, and customers paid for distribution of their own malware. ATT&CK records the family under two names and links it publicly to one major customer group.
| Name or entity | Type | What the sources say |
|---|---|---|
| Emotet, Geodo | Malware family (ATT&CK S0367) | Modular Windows downloader, emerged June 2014, initially aimed at the financial sector (ATT&CK). |
| Wizard Spider | Russia-based financially motivated group (G0102) | Creator of TrickBot; listed by ATT&CK as an Emotet user. Also tracked as UNC1878, Grim Spider, FIN12 and Periwinkle Tempest, among others. |
| TrickBot (S0266) | Payload delivered by Emotet | Trojan that emerged in September 2016 and was later used in "big game" ransomware (ATT&CK). |
| IcedID (S0483) | Payload delivered by Emotet | Modular banking malware downloaded by Emotet in multiple campaigns (ATT&CK). |
Public reporting rarely names Emotet's operators as individuals; the DOJ release on the 2021 operation does not name defendants. Attribution beyond "Russian-speaking cybercriminal" should be left to the sources that state it.
Targeting and motivation
Emotet was financially motivated and indiscriminate at the point of infection. DOJ lists banking, e-commerce, healthcare, academia, government and technology among the industries it hit, and notes victims in local, state, tribal and federal government and in critical infrastructure.
- Scale: investigators identified about 1.6 million computers worldwide that appear to have been infected between 1 April 2020 and 17 January 2021, over 45,000 of them in the United States (DOJ).
- Cost: CISA reported infections cost state, local, tribal and territorial governments up to 1 million US dollars per incident to remediate. DOJ cites a North Carolina school district whose network was disabled for about two weeks in 2017, with losses above 1.4 million US dollars.
- Business model: Emotet sold installs. Each infected computer was worth more when it sat on a corporate domain, because that access could be resold to TrickBot and ransomware operators.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 maps 47 techniques to Emotet. The table groups those most useful for building detections and hardening plans.
| Stage | ATT&CK techniques | What defenders see |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1204.002 Malicious File, T1204.001 Malicious Link | Invoices, shipping notices and reply-chain emails with macro documents, PDFs or links (CISA TA18-201A). |
| Execution | T1059.005 Visual Basic, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1218.010 Regsvr32, T1047 Windows Management Instrumentation | Office applications spawning script or command interpreters; regsvr32 loading a DLL from a user folder. |
| Persistence | T1547.001 Registry Run Keys / Startup Folder, T1543.003 Windows Service, T1053.005 Scheduled Task, T1036.004 Masquerade Task or Service | Run keys and services with names chosen to look legitimate. |
| Stealth and evasion | T1027.002 Software Packing, T1027.009 Embedded Payloads, T1055.001 Dynamic-link Library Injection, T1055.012 Process Hollowing, T1620 Reflective Code Loading | Polymorphic binaries that defeat hash and signature matching; code in explorer.exe and other processes. |
| Credential access | T1003.001 LSASS Memory, T1555.003 Credentials from Web Browsers, T1552.001 Credentials In Files, T1110.001 Password Guessing, T1040 Network Sniffing | Access to LSASS and browser stores; repeated failed logons against admin accounts. |
| Collection | T1114.001 Local Email Collection, T1087.003 Email Account | Outlook data read by a non-Outlook process. |
| Lateral movement | T1021.002 SMB/Windows Admin Shares, T1078.003 Local Accounts, T1570 Lateral Tool Transfer, T1210 Exploitation of Remote Services | Files written to ADMIN$ or C$ on peer workstations followed by service creation. |
| Command and control | T1071.001 Web Protocols, T1571 Non-Standard Port, T1573.001 Symmetric Cryptography, T1105 Ingress Tool Transfer | HTTP or HTTPS on unusual ports to rotating IP addresses, then download of new modules or payloads. |
How they abuse identities and credentials
Emotet's identity abuse explains its speed. Every infection harvested the material for the next wave.
- Mailbox and contacts: CISA describes an Outlook scraper that collected contacts and names, plus Mail PassView for mail client passwords. The result was malspam sent from, or appearing to come from, someone the recipient knew.
- Stored passwords: NetPass and WebBrowserPassView modules recovered saved network and browser credentials (CISA). Browser password storage on managed devices is a policy decision worth revisiting. See the Credential Dumping Guide.
- Shared local administrator passwords: the spreader brute-forced accounts and used admin shares. A single local administrator password reused across hundreds of workstations turns one infection into hundreds. Windows LAPS gives every device its own rotating password.
- Token impersonation: ATT&CK lists T1134.001 Token Impersonation/Theft, so a privileged user logging on to an infected machine helps the malware. CISA explicitly warns responders not to log in to infected systems with domain or shared local administrator accounts.
- Service and machine accounts: files and scripts on file shares often hold service account passwords (T1552.001). Find and vault them. See the Secrets Management Guide.
Notable incidents
| Date | Event | Source and key facts |
|---|---|---|
| June 2014 | First emergence | ATT&CK: initially targeting the financial sector. |
| 2017 | North Carolina school district infection | DOJ: network disabled for about two weeks, more than 1.4 million US dollars in losses. |
| July 2018 | CISA alert TA18-201A | Described Emotet as an advanced modular banking trojan, with malspam imitating PayPal receipts, shipping notices and past-due invoices, and SMB spreading. |
| April 2020 to January 2021 | Peak botnet size | DOJ: about 1.6 million infected computers identified worldwide in this window. |
| January 2021 (announced 28 January) | International disruption by the US, Canada, France, Germany, the Netherlands and the UK, with Lithuania, Sweden and Ukraine assisting | Law enforcement replaced files on Emotet servers so infected computers downloaded a file that cut operator communication and blocked further installs. The FBI notified more than 20 US hosting providers about 45 or more compromised IP addresses and authorities in over 50 countries. The Dutch police provided an email check service for addresses captured by Emotet. |
Emotet activity resumed later in 2021 after the disruption, which is why the family remains in threat reports; the January 2021 action also did not remove malware Emotet had already installed. The lesson for defenders is that a takedown buys time, not safety. See the Cybercrime Law Enforcement Takedowns Guide.
Detection and defence
Behaviour-level detection ideas
- Office spawning interpreters: WINWORD.EXE or EXCEL.EXE as parent of powershell.exe, cmd.exe, wscript.exe or regsvr32.exe (Sysmon Event ID 1 or EDR process events).
- Client-to-client SMB writes: a workstation writing executables to ADMIN$ on other workstations, followed by remote service creation (System Event ID 7045 on the target).
- Password guessing from inside: many Security Event ID 4625 failures against one administrator account from an internal workstation, then a 4624 success.
- Outlook data access: a non-Outlook process reading OST or PST files, or MAPI activity from an unexpected process.
- Persistence: new services or Run keys with random or masquerading names pointing to AppData or System32 lookalike paths.
- Outbound pattern: HTTP traffic to bare IP addresses on non-standard ports from non-browser processes. See the Beaconing and C2 Detection Guide.
Hardening mapped to frameworks
| Control (source) | What it stops | Framework reference |
|---|---|---|
| Windows Firewall rule by Group Policy restricting inbound SMB between clients (CISA) | Worm-like spread across workstations | NIST SP 800-53 SC-7; CIS Control 4 |
| Block attachment types such as .dll, .exe and unscannable archives at the gateway (CISA) | First-stage delivery | NIST SP 800-53 SI-3, SI-8; CIS Control 9 |
| Block macros in files from the internet | Macro document execution | NIST SP 800-53 CM-7 |
| Least privilege and limited administrative credentials (CISA); unique local admin passwords | Brute force and admin share abuse | NIST SP 800-53 AC-6, IA-5 |
| DMARC and external email banners (CISA) | Spoofed sender abuse | CIS Control 9 |
| Antivirus and EDR on clients and servers with automatic updates (CISA) | Known variants and post-exploitation behaviour | NIST SP 800-53 SI-3, SI-4; NIST CSF 2.0 DE.CM-09 |
Priorities by organisation size
| Organisation | First three actions | Trade-off to accept |
|---|---|---|
| Small (no SOC, managed IT) | Turn on built-in macro blocking and attachment filtering in the mail service, deploy unique local admin passwords, enable the endpoint protection product's tamper protection | Some legitimate macro workbooks need a trusted location or signing; plan that before enforcement. |
| Mid-sized (small security team) | Add the client SMB firewall rule, Office child-process alerts and an isolation runbook | Peer-to-peer file sharing between desktops stops; move it to managed file shares. |
| Large (SOC and detection engineering) | Correlate email, endpoint and identity telemetry so a malspam click, a 4625 burst and an ADMIN$ write appear as one incident; test rules with emulation | Correlation rules need tuning time; run them in alert-only mode for a month first. |
Response, following CISA guidance
- Isolate infected workstations; with multiple infections, disconnect affected segments and consider taking the network offline temporarily.
- Do not log in to infected systems with domain or shared local administrator accounts.
- Reimage infected machines, then move verified clean systems to a containment VLAN.
- Reset domain and local passwords and any application passwords stored on compromised machines.
- Identify patient zero and review the user's mailbox rules, especially auto-forwarding to external addresses.
- Hunt for the payloads Emotet delivered (TrickBot, IcedID, QakBot) and for ransomware precursors. See the Malware Outbreak Playbook.
Metrics that show it is working
- Percentage of workstations where inbound client-to-client SMB is blocked.
- Percentage of devices with unique, rotated local administrator passwords.
- Office child-process alerts per month and median time to triage.
- Time from first confirmed infection to all affected hosts reimaged.
- Number of internal password-guessing alerts against administrator accounts that reach investigation.
Practitioner checklist
- Deploy a Group Policy firewall rule blocking inbound SMB between workstations, with exceptions only for documented management hosts.
- Roll out Windows LAPS or an equivalent so no two devices share a local administrator password.
- Block internet macros and dangerous attachment types at the gateway and in Office policy.
- Alert on Office applications spawning script hosts, regsvr32 or rundll32.
- Alert on internal brute force against administrator accounts and on executables written to ADMIN$.
- Remove stored service account passwords from scripts and shares and move them into a vault.
- Write a response runbook that forbids admin logons to infected hosts and mandates reimaging.
- Check takedown victim notification services and national CERT feeds after major operations.
Standards and references
- MITRE ATT&CK: Emotet (S0367)
- CISA: Emotet Malware (TA18-201A)
- US Department of Justice: Emotet Botnet Disrupted in International Cyber Operation
- MITRE ATT&CK: Wizard Spider (G0102)
- MITRE ATT&CK: TrickBot (S0266)
- MITRE ATT&CK: SMB/Windows Admin Shares (T1021.002)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · QakBot Malware Guide · Botnets Guide · Office Macro Blocking Guide