urlscan.io logo urlscan.io
SecurityTrails logo

www.spamtitan.com Open in urlscan Pro
75.119.211.125  Public Scan

Back to summary
URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/
Submission: On November 08 via api from US — Scanned from DE

Form analysis 3 forms found in the DOM

GET https://www.spamtitan.com/blog/

<form role="search" method="get" class="et-search-form" action="https://www.spamtitan.com/blog/">
  <input type="search" class="et-search-field" placeholder="Search …" value="" name="s" title="Search for:">
</form>

POST //trust.titanhq.com/acton/forms/userSubmit.jsp

<form class="ao-form ao-responsive" id="ao-form-ac7228c3-c0dc-43a6-8e67-755731ad722b" method="POST" action="//trust.titanhq.com/acton/forms/userSubmit.jsp" data-validate-blur="">
  <div class="ao-row" id="row-">
    <div class="ao-column ao-column-12 tablet-ao-column-1 mobile-ao-column-1" id="column-c1527602162639">
      <div class="ao-column-inner">
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1527584868950" class="ao-richtext-block">
            <p style="text-align: center;"><span style="font-family: arial, helvetica, sans-serif; font-size: 15pt;">Is your email secure? </span></p>
            <p style="text-align: center;"><span style="font-family: arial, helvetica, sans-serif; font-size: 15pt;">Read our</span><br><br><span style="font-size: 20pt;"><strong><span
                    style="font-family: 'arial black', 'arial bold', sans-serif;">SPAM FILTERING ESSENTIALS CHECKLIST</span></strong></span></p>
            <p style="text-align: center;">&nbsp;</p>
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1527584892370" class="ao-input-block ao-left">
            <label for="b1527584892370" class="ao-form-label">
            </label>
            <input id="b1527584892370" name="firstname" type="text" placeholder="Enter Your Name " value="" data-type="text" tabindex="1" class="ao-form-field ao-left" data-error-message="" data-validator="">
            <span class="ao-form-error-message">&nbsp;</span>
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1527584902210" class="ao-input-block ao-left">
            <label for="b1527584902210" class="ao-form-label">
            </label>
            <input id="b1527584902210" name="Email Address" type="text" placeholder="Enter Your Email *" value="" data-type="text" tabindex="2" class="ao-form-field ao-left" data-error-message="required|Required field::email|Invalid email address"
              data-validator="required|email">
            <span class="ao-form-error-message">&nbsp;</span>
          </div>
        </div>
        <div style="" class="ao-block-wrapper">
          <div id="block-b1527585004301" class="ao-submit-block">
            <div style="text-align: center">
              <button type="submit" class="ao-form-submit"
                style="background-color: rgb(0, 186, 160); background-image: none; background-repeat: no-repeat; background-size: auto; background-position: center center; color: rgb(255, 255, 255); border-radius: 6px; display: inline-block; text-decoration: none; font-size: 12pt; font-weight: normal; font-family: 'Arial Black', 'Arial Bold', sans-serif; font-style: normal; border-style: solid; border-color: transparent; padding: 10px;"
                tabindex="3" onmouseover="this.style.backgroundColor = '#8f2626'; this.style.color = '#ffffff'; this.style.borderColor = 'transparent';"
                onmouseout="this.style.backgroundColor = '#00BAA0'; this.style.color = '#ffffff'; this.style.borderColor = 'transparent';">Get your FREE Guide</button>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>
  <div class="ao-row" id="row-r1527601946373">
    <div class="ao-column ao-column-12 tablet-ao-column-1 mobile-ao-column-1" id="column-c1527591934110">
      <div class="ao-column-inner">
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528283888890" class="ao-hidden-block">
            <input id="b1528283888890" name="KEYWORDS" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528283909680" class="ao-hidden-block">
            <input id="b1528283909680" name="Medium" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528283928306" class="ao-hidden-block">
            <input id="b1528283928306" name="First Conversion Event" type="hidden" value="SUB_SPAMTITAN.COM_SPAM_FILTERING CHECKLIST" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528283984463" class="ao-hidden-block">
            <input id="b1528283984463" name="This Visit" type="hidden" value="2022-11-8 23:5:16" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284006271" class="ao-hidden-block">
            <input id="b1528284006271" name="thquuid" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284019342" class="ao-hidden-block">
            <input id="b1528284019342" name="gclid" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284030128" class="ao-hidden-block">
            <input id="b1528284030128" name="Lead Source" type="hidden" value="DIRECT TRAFFIC" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284056799" class="ao-hidden-block">
            <input id="b1528284056799" name="Lead Campaign" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284068983" class="ao-hidden-block">
            <input id="b1528284068983" name="First Page Viewed" type="hidden" value="https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284090982" class="ao-hidden-block">
            <input id="b1528284090982" name="First Referrer" type="hidden" value="DIRECT" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284110431" class="ao-hidden-block">
            <input id="b1528284110431" name="First Visit" type="hidden" value="2022-11-8 23:5:16" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284123792" class="ao-hidden-block">
            <input id="b1528284123792" name="utm_source" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284135431" class="ao-hidden-block">
            <input id="b1528284135431" name="utm_medium" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284147160" class="ao-hidden-block">
            <input id="b1528284147160" name="_GEO_COUNTRY_CODE" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284187564" class="ao-hidden-block">
            <input id="b1528284187564" name="_IPADDR" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284208561" class="ao-hidden-block">
            <input id="b1528284208561" name="_FORM" type="hidden" value="SUB_SPAMTITAN.COM_SPAM_FILTERING CHECKLIST" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284226256" class="ao-hidden-block">
            <input id="b1528284226256" name="_TIME" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284241207" class="ao-hidden-block">
            <input id="b1528284241207" name="Product Type" type="hidden" value="SpamTitan" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1528284285664" class="ao-hidden-block">
            <input id="b1528284285664" name="_CAMPAIGN" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="" class="ao-block-wrapper">
          <div id="block-b1528284302308" class="ao-hidden-block">
            <input id="b1528284302308" name="_SEARCH" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
      </div>
    </div>
  </div>
  <input type="hidden" name="ao_form_neg_cap" value="">
  <input type="hidden" name="ao_bot" id="ao_bot" value="nope">
  <input type="hidden" name="ao_a" value="31047">
  <input type="hidden" name="ao_f" value="ac7228c3-c0dc-43a6-8e67-755731ad722b">
  <input type="hidden" name="ao_d" value="ac7228c3-c0dc-43a6-8e67-755731ad722b:d-0001">
  <input type="hidden" name="ao_jstzo" value="">
  <input type="hidden" name="ao_refurl" value="">
  <input type="hidden" name="ao_target" value="https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/">
  <input type="hidden" name="ao_cuid" value="">
  <input type="hidden" name="ao_srcid" value="">
  <input type="hidden" name="ao_nc" value="">
  <input type="hidden" name="ao_pf" value="0">
  <input type="hidden" name="ao_camp" value="">
  <input type="hidden" name="ao_campid" value="">
  <input type="hidden" name="ao_refemail" value="">
  <input type="hidden" name="ao_iframe" value="">
  <input type="hidden" name="ao_gatedpage" value="">
  <input type="hidden" name="ao_gatedasset" value="">
</form>

POST //trust.titanhq.com/acton/forms/userSubmit.jsp

<form class="ao-form " id="ao-form-b8e20052-9853-49b4-a03b-e900a9837361" method="POST" action="//trust.titanhq.com/acton/forms/userSubmit.jsp" data-validate-blur="">
  <div class="ao-row" id="row-">
    <div class="ao-column ao-column-12 tablet-ao-column-1 mobile-ao-column-1" id="column-">
      <div class="ao-column-inner">
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1512469237318" class="ao-input-block ao-left">
            <label for="b1512469237318" class="ao-form-label"> First Name <span class="ao-required">*</span>
            </label>
            <input id="b1512469237318" name="firstname" type="text" placeholder=" " value="" data-type="text" tabindex="101" class="ao-form-field ao-left" data-error-message="required|Required field" data-validator="required">
            <span class="ao-form-error-message">&nbsp;</span>
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1497454764528" class="ao-input-block ao-center">
            <label for="b1497454764528" class="ao-form-label"> Email <span class="ao-required">*</span>
            </label>
            <input id="b1497454764528" name="Email Address" type="text" placeholder=" " value="" data-type="text" tabindex="102" class="ao-form-field ao-center" data-custom=".*^[\w-\.\+]+@([\w-]+\.)+[\w-]{2,4}$"
              data-error-message="required|Required field::email|Invalid email address::custom|Invalid" data-validator="required|email|custom">
            <span class="ao-form-error-message">&nbsp;</span>
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1497454793717" class="ao-submit-block">
            <div style="text-align: center">
              <button type="submit" class="ao-form-submit"
                style="background-color: rgb(51, 102, 153); background-image: none; background-repeat: no-repeat; background-size: auto; background-position: center center; color: rgb(255, 255, 255); border-radius: 6px; display: inline-block; text-decoration: none; font-size: 12pt; font-weight: normal; font-style: normal; border-style: solid; border-color: transparent; border-width: 0px; padding: 10px;"
                tabindex="103" onmouseover="this.style.backgroundColor = '#224466'; this.style.color = '#ffffff'; this.style.borderColor = 'transparent';"
                onmouseout="this.style.backgroundColor = '#336699'; this.style.color = '#ffffff'; this.style.borderColor = 'transparent';">Subscribe!</button>
            </div>
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1523965092377" class="ao-hidden-block">
            <input id="b1523965092377" name="KEYWORDS" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1523965136510" class="ao-hidden-block">
            <input id="b1523965136510" name="This Visit" type="hidden" value="2022-11-8 23:5:16" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1523965109526" class="ao-hidden-block">
            <input id="b1523965109526" name="First Conversion Event" type="hidden" value="SUB_SPAMTITAN_NEWSLETTERSIGNUP" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1523965063188" class="ao-hidden-block">
            <input id="b1523965063188" name="Medium" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1512140449549" class="ao-hidden-block">
            <input id="b1512140449549" name="thquuid" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1507895764359" class="ao-hidden-block">
            <input id="b1507895764359" name="gclid" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1511192578446" class="ao-hidden-block">
            <input id="b1511192578446" name="Lead Source" type="hidden" value="DIRECT TRAFFIC" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1512140491385" class="ao-hidden-block">
            <input id="b1512140491385" name="Lead Campaign" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1510933611184" class="ao-hidden-block">
            <input id="b1510933611184" name="First Page Viewed" type="hidden" value="https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1507895665370" class="ao-hidden-block">
            <input id="b1507895665370" name="First Referrer" type="hidden" value="DIRECT" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1510933594669" class="ao-hidden-block">
            <input id="b1510933594669" name="First Visit" type="hidden" value="2022-11-8 23:5:16" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1512140539062" class="ao-hidden-block">
            <input id="b1512140539062" name="utm_source" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1512140549856" class="ao-hidden-block">
            <input id="b1512140549856" name="utm_medium" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1507895682791" class="ao-hidden-block">
            <input id="b1507895682791" name="_IPADDR" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1507895717143" class="ao-hidden-block">
            <input id="b1507895717143" name="_FORM" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1507895746923" class="ao-hidden-block">
            <input id="b1507895746923" name="_TIME" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1509623922417" class="ao-hidden-block">
            <input id="b1509623922417" name="Product Type" type="hidden" value="spamtitan" class="ao-hidden-block">
          </div>
        </div>
        <div style="padding-bottom: 0px;" class="ao-block-wrapper">
          <div id="block-b1508930773950" class="ao-hidden-block">
            <input id="b1508930773950" name="_CAMPAIGN" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
        <div style="" class="ao-block-wrapper">
          <div id="block-b1508930784356" class="ao-hidden-block">
            <input id="b1508930784356" name="_SEARCH" type="hidden" value="" class="ao-hidden-block">
          </div>
        </div>
      </div>
    </div>
  </div>
  <input type="hidden" name="ao_form_neg_cap" value="">
  <input type="hidden" name="ao_bot" id="ao_bot" value="nope">
  <input type="hidden" name="ao_a" value="31047">
  <input type="hidden" name="ao_f" value="b8e20052-9853-49b4-a03b-e900a9837361">
  <input type="hidden" name="ao_d" value="b8e20052-9853-49b4-a03b-e900a9837361:d-0001">
  <input type="hidden" name="ao_jstzo" value="">
  <input type="hidden" name="ao_refurl" value="">
  <input type="hidden" name="ao_target" value="https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/">
  <input type="hidden" name="ao_cuid" value="">
  <input type="hidden" name="ao_srcid" value="">
  <input type="hidden" name="ao_nc" value="">
  <input type="hidden" name="ao_pf" value="0">
  <input type="hidden" name="ao_camp" value="">
  <input type="hidden" name="ao_campid" value="">
  <input type="hidden" name="ao_refemail" value="">
  <input type="hidden" name="ao_iframe" value="">
  <input type="hidden" name="ao_gatedpage" value="">
  <input type="hidden" name="ao_gatedasset" value="">
</form>

Text Content

 * Solutions
   * Gateway Anti-Spam Appliance
   * Cloud Anti-Spam Service
   * Private Cloud for Service Providers and Enterprise customers
   * SpamTitan Plus
   * EncryptTitan
 * Industries
   * SME/SMB
   * ISP/MSP
   * Education
 * Testimonials
 * Pricing
 * Contact
 * Start free trial
 * Get a Quote
 * Book Demo

Select Page
 * Solutions
   * Gateway Anti-Spam Appliance
   * Cloud Anti-Spam Service
   * Private Cloud for Service Providers and Enterprise customers
   * SpamTitan Plus
   * EncryptTitan
 * Industries
   * SME/SMB
   * ISP/MSP
   * Education
 * Testimonials
 * Pricing
 * Contact
 * Start free trial
 * Get a Quote
 * Book Demo




EMOTET MALWARE REVIVES OLD EMAIL CONVERSATIONS THREADS TO INCREASE INFECTION
RATES

by titanadmin | Apr 12, 2019 | Email Scams, Phishing & Email Spam, Spam News |

Emotet malware was first identified in 2014 and its original purpose was to
obtain banking credentials and other sensitive information; however, the malware
is regularly updated and new functionality is added. Emotet malware is now one
of the most prevalent and dangerous malware threats faced by businesses.

The malware can detect whether it is running in a virtual environment and will
generate false indicators in such cases. The malware is polymorphic, which means
it changes every time it is downloaded. That makes it difficult to detect using
the signature-based detection methods employed by standard anti-virus software.

The malware also has worm-like features which allows it to rapidly spread to
other networked computers. Emotet is also capable of spamming and forwarding
itself to email contacts. As if infection with Emotet is not bad enough, it can
also download other malware variants onto infected devices.

Emotet malware is one of the most destructive malware variants currently in use
and cleaning up Emotet attacks can be incredibly costly. The Department of
Homeland Security has reported that some attacks on state, local, tribal, and
territorial governments have cost more than $1 million to resolve.

Emotet malware is primarily distributed via spam email, either through malicious
attachments or hyperlinks to websites where the malware is silently downloaded.
The lures used in the messages are highly varied and include most of the
commonly used phishing lures such as shipping notifications, fake invoices,
payment requests, PayPal receipts.

Now the threat actors behind the malware have adopted a new tactic to increase
infection rates. Once installed on a device, the malware accesses email
conversation threads and forwards the message to individuals named in the
thread.

The original email conversation is unaltered, but a hyperlink is added to the
top of the message. The link directs the recipient to a webpage where a file
download is triggered. Opening the document and enabling macros will see Emotet
downloaded. Email attachments may also be added to previous conversation threads
in place of hyperlinks.

Since the messages come from a known individual with whom an email conversation
has taken place in the past, the probability of the document being opened is
greater than if messages come out of the blue or are sent from an unknown
individual.

Several cybersecurity firms have identified a campaign using this tactic,
including phishing intelligence provider Cofense and security researcher Marcus
Hutchins (MalwareTech).

The current campaign uses revived conversations from before November 2018,
although more recent conversations may be revived in further campaigns. Any
revived old email conversation that contains a link or an attachment could
indicate a user has been targeted and that at least one member of the email
exchange has been infected with Emotet.

The current campaign is not only extensive, it is also proving to be extremely
successful. Spamhaus reports that there have been 47,000 new infections in the
past two months alone, while Cofense reports that it has identified more than
700,000 infections in the past 12 months.

Protecting against this dangerous malware requires a powerful anti-spam solution
and good security awareness training for staff. SpamTitan’s new features can
help to detect malicious emails spreading Emotet malware to better protect
businesses from attack.

To find out more about SpamTitan and how the solution can protect your business,
give TitanHQ a call today.


 * Facebook
 * Twitter
 * Google+
 * LinkedIn



Is your email secure?

Read our

SPAM FILTERING ESSENTIALS CHECKLIST

 

 
 
Get your FREE Guide


SUBSCRIBE TO OUR NEWSLETTER

First Name *  
Email *  
Subscribe!





















 * SALES

 * USA +1 813 200 9450
 * UK/EU +44 (0)2476993640
 * Ireland +353 91 545555
 * Mid East +971 4 3886998


 * SUPPORT

 * USA +1 813 200 9450
 * UK/EU +44 (0)2476993640
 * Ireland +353 91 545555
 * Mid East +971 4 3886998

 * Anti-Spam Solutions
 * Web Filtering Solutions
 * Email Archiving Solutions
 * Contact Us
 * Spam Blog
 * TitanHQ News
 * Filtering Blog

 * Privacy Statement
 * Cookies Policy
 * Sitemap

© TitanHQ 2022. All rights reserved. TitanHQ is a trading name of Copperfasten
Technologies, Registered in the Republic of Ireland No. 263031

 * Facebook
 * Twitter
 * Google
 * RSS