2014

Year Emotet first appeared

1.6M+

Infected computers identified (Apr 2020 – Jan 2021)

~1,000%

Increase in loader downloads during July–Aug 2020 resurgence

Jan 2021

International law enforcement takedown — Operation Ladybird

Emotet first appeared in June 2014 as a banking trojan. Its original purpose was straightforward: compromise a victim, steal financial credentials, enable fraud. Over the following seven years it became something far more significant — not just malware, but infrastructure. A delivery platform. A criminal ecosystem enabler.

By the time law enforcement took it down in January 2021, Emotet had facilitated hundreds of millions of dollars in damage worldwide, served as the initial access mechanism for TrickBot, IcedID, QakBot, and multiple ransomware families, and infected over 1.6 million computers across more than 45,000 of which were in the United States alone.

Understanding Emotet isn't really about understanding one malware family. It's about understanding how the modern cybercrime supply chain works — and why the malware responsible for the initial compromise is often not the malware responsible for the final damage.

From Banking Trojan to Malware Platform

Emotet's 2014 incarnation was conventional. It targeted the financial sector, intercepted banking transactions, and harvested credentials. That version is largely unremarkable in retrospect — the threat landscape of 2014 was full of banking trojans operating on similar principles.

What separated Emotet from its contemporaries was what happened next. Rather than remaining a single-purpose tool, its operators made a deliberate architectural decision: make it modular. Instead of shipping every capability inside one static binary, Emotet would deliver different modules to different victims depending on what the operator wanted to accomplish.

Those modules — documented by MITRE — could perform tasks including:

— Outlook email scraping and address harvesting

— Browser credential and password theft

— LSASS credential dumping via Mimikatz-based modules

— Network share and system discovery

— Wi-Fi network enumeration

— SMB-based lateral movement

— Process injection

— Downloading and executing additional malware payloads

This modularity became Emotet's defining characteristic. The operator could decide, per victim, what the infection should accomplish — and deliver only the modules needed. That flexibility is what allowed Emotet to transition from a banking trojan into a general-purpose malware platform.

The Emotet Business Model

Once a machine joined the Emotet botnet, operators could decide what additional components to deliver. This is the concept that matters most for understanding Emotet's place in the threat landscape.

Emotet became a Malware-as-a-Service loader — renting out access to its botnet to other criminal groups who would deliver their own payloads through Emotet's established foothold. The U.S. Department of Health and Human Services describes Emotet as a significant component of the cybercriminal ecosystem with documented relationships to multiple major criminal groups.

Payloads delivered through Emotet included:

— TrickBot

— leading to Ryuk and Conti ransomware deployments

— IcedID

— used for banking fraud and further malware delivery

— QakBot

— credential theft and initial access brokerage

— Azorult

— data and credential theft

— BitPaymer ransomware

— direct ransomware deployment

The critical lesson here is the decoupling of initial access from final impact. The infection chain often looked like this: a victim receives a phishing email, Emotet installs, Emotet delivers TrickBot, TrickBot conducts domain reconnaissance and deploys Ryuk ransomware weeks later. Three separate malware families. Three separate criminal groups potentially involved. One phishing email.

ANALYST NOTE

This decoupling is why incident responders investigating a ransomware deployment often trace the initial access back to an Emotet infection that happened weeks or months earlier — and why cleaning the ransomware payload without identifying and removing the initial access mechanism leaves the network re-exploitable.

How Emotet Gets In: Delivery Mechanisms

Emotet's primary delivery mechanism was phishing — spear phishing attachments and spear phishing links, as documented in CISA's 2020 advisory AA20-280A. But its delivery techniques evolved significantly over its lifespan, consistently adapting to defensive changes.

Email thread hijacking

One of Emotet's most effective delivery innovations was thread hijacking — injecting malicious replies into real stolen email conversations. By compromising a victim's mailbox and responding to existing threads with malicious attachments, Emotet campaigns bypassed the natural suspicion around cold phishing. The recipient received what appeared to be a reply from a known contact in an ongoing conversation. CISA documented this technique specifically in the 2020 resurgence campaigns.

Malicious documents and the macro pivot

For years, Emotet relied on malicious Microsoft Office documents with embedded macros. A victim would receive what appeared to be a legitimate document, enable macros when prompted, and execute the infection chain. CISA documented campaigns using password-protected ZIP archives as an additional layer — the password was included in the email body, forcing the victim to interact with the archive themselves, which helped bypass automated email security gateways.

Social engineering lures

Emotet campaigns adapted their lure content to current events. During 2020, CISA documented COVID-19-themed lures alongside the return of more conventional financial and invoice-themed documents. The lure content was secondary to the delivery mechanism — Emotet's operators were pragmatic about what worked.

1. Phishing email arrives: Delivered via spear phishing link or attachment, often appearing as a reply in an existing email thread from a known contact (thread hijacking).

2. User interaction triggers execution: User opens attachment and enables macros, or clicks a link that downloads a malicious document or archive. Password-protected ZIPs were commonly used to bypass email gateway scanning.

3. Macro or script executes: The document launches cmd.exe or PowerShell to download and execute the Emotet payload. MITRE documents WMI also being used to execute PowerShell.

4. Emotet payload loads and establishes C2: Emotet decrypts its configuration, connects to C2 infrastructure via HTTP, and registers the victim. RSA encryption and Protocol Buffers were used for C2 serialization in documented variants.

5. Modules and follow-on payloads delivered: Operator decides what to deploy: credential-theft modules, lateral movement modules, or full secondary payloads like TrickBot or QakBot.

Worm-Like Propagation

After compromising a system, Emotet didn't simply wait for operator instructions. It could actively propagate through the network — a capability CISA specifically called out as making Emotet particularly difficult to combat.

Documented propagation techniques include:

— Credential brute forcing — Emotet used hard-coded password lists against accounts on the local network, attempting to move laterally via valid credentials.

— SMB lateral movement — Emotet leveraged Windows administrative shares (ADMIN$, C$, IPC$) to move to adjacent systems using harvested or brute-forced credentials.

— EternalBlue / MS17-010 exploitation — Emotet has been observed exploiting the same SMB vulnerability used by WannaCry, enabling propagation to unpatched systems without needing credentials at all.

— Wi-Fi network enumeration — Emotet could enumerate available Wi-Fi networks and attempt to connect to adjacent networks to expand its reach beyond the initially compromised segment.

DETECTION NOTE

The worm-like propagation is what turns a single phishing click into an organization-wide incident. Defenders should monitor for unusual SMB lateral movement, unexpected ADMIN$ connections, and authentication failures in patterns consistent with credential spraying — all of which may indicate Emotet propagating rather than Emotet on a single host.

Persistence Mechanisms

Emotet used several persistence mechanisms across its variants. MITRE documents three primary approaches, each of which presents distinct detection opportunities.

Defense Evasion

Emotet accumulated a substantial collection of evasion techniques over its lifespan. MITRE documents a range of methods that collectively made static detection unreliable.

— Binary padding — inflating file size to evade detection mechanisms based on size thresholds or processing limits

— Custom packing and embedded payloads — obfuscating the malicious code from static analysis

— Command obfuscation — encoding and encrypting command-line arguments passed to PowerShell or cmd.exe

— Self-extracting archives — used as delivery containers to complicate automated analysis

— Encoded and encrypted files — C2 traffic encrypted with RSA; data serialized with Protocol Buffers

Binary padding became particularly notable in later Emotet variants. The malware could inflate executables to sizes that caused some analysis tools and sandboxes to skip processing. This is a good reminder that file-size-based heuristics cut both ways — they can be gamed.

Process Injection

Emotet used process injection to execute code within the memory space of legitimate processes, hiding its activity from process-listing tools and file-based detection. MITRE documents three injection techniques: DLL injection, process hollowing, and reflective code loading.

One documented technique involved launching a legitimate Windows binary — certutil.exe — in a suspended state and loading malicious code into it before resuming execution. The running process appeared legitimate. The code executing inside it was not.

DETECTION NOTE

Don't ask whether Emotet is running. Ask whether a normally well-behaved process is behaving like an injection target — making unexpected network connections, accessing credential stores, or spawning child processes inconsistent with its documented behavior. certutil.exe initiating outbound network connections is anomalous regardless of whether Emotet is the cause.

Command and Control

Emotet used HTTP-based C2, with communications encrypted using RSA and serialized using Protocol Buffers. CISA's 2020 observations identified HTTP POST requests with unusual, random-looking URI paths as characteristic of Emotet C2 traffic. Common ports included 80, 443, and 8080, with some activity over port 445 (SMB).

Emotet's C2 infrastructure used a tiered model. Infected machines could be promoted to act as proxy nodes — relaying traffic between other infected machines and the actual operator-controlled servers. This made takedown significantly harder: blocking known C2 IPs affected only the visible tier, while the operator infrastructure remained intact behind the proxy layer.

DETECTION NOTE

Look for unexpected outbound HTTP POST requests from processes with no legitimate reason to make them — especially from Office applications or their child processes. Random-looking URI paths with consistent POST patterns to changing IP ranges are a reliable behavioral indicator across Emotet variants.

The 2020 Resurgence

Emotet went dormant in February 2020. When it returned in July 2020, it did so aggressively. CISA documented a significant increase in Emotet activity targeting state and local governments, and reported approximately 16,000 Emotet-related alerts on federal civilian networks through its EINSTEIN intrusion-detection system during the July–September 2020 period alone.

By August, researchers observed approximately a 1,000% increase in Emotet loader downloads compared to the prior period. The resurgence campaigns featured updated delivery techniques: COVID-19-themed lures alongside conventional financial themes, renewed use of thread hijacking, and password-protected archive delivery to bypass gateway filtering.

During this period, CISA specifically documented Emotet delivering TrickBot — which subsequently facilitated ransomware operations — and QakBot for credential and data theft. The Emotet-to-TrickBot-to-Ryuk chain became one of the most destructive attack patterns of 2020, responsible for a significant portion of that year's ransomware incidents.

Operation Ladybird: The 2021 Takedown

On January 27–28, 2021, an international law enforcement operation coordinated across nine countries — the United States, Canada, France, Germany, Netherlands, United Kingdom, Lithuania, Sweden, and Ukraine — disrupted Emotet's infrastructure.

The approach mirrored what would later be used against QakBot in Operation Duck Hunt: law enforcement didn't simply seize servers. They took control of Emotet's infrastructure and replaced malicious components with law-enforcement- controlled infrastructure, then used Emotet's own update mechanism to push a file designed to disconnect infected systems from the botnet on April 25, 2021.

The scale of the operation was significant. Law enforcement identified approximately 1.6 million potentially infected computers worldwide between April 2020 and January 2021, of which more than 45,000 were in the United States. The DOJ estimated that Emotet had caused hundreds of millions of dollars in worldwide damage.

IMPORTANT CAVEAT

The DOJ explicitly noted that the operation was designed to prevent further communication with Emotet operators and prevent additional malware installation — not to remediate other malware already present on compromised machines. Organisations whose machines were cleaned of Emotet were not necessarily clean. TrickBot, QakBot, or ransomware already deployed through Emotet remained entirely outside the operation's scope.

Detection Engineering: Building Behavioral Detections

Emotet's hash and domain IOCs changed constantly across its lifespan. Durable detection requires focusing on behavioral patterns — the sequences of actions that persist across variants regardless of what the payload looks like.

MITRE ATT&CK Coverage

Mitigation Layers

Closing Thoughts

Emotet's history demonstrates how malware stopped being a single tool and became a supply chain. Its evolution — banking trojan, then modular platform, then botnet, then malware loader, then ransomware ecosystem enabler — tracks almost exactly with the broader professionalization of cybercrime that defined the late 2010s and early 2020s.

The key lesson isn't technical. It's structural. The malware responsible for the initial compromise is often not the malware responsible for the final damage. Emotet got in. TrickBot did the reconnaissance. Ryuk encrypted the files. Three separate operators. Three separate criminal ecosystems. One phishing email.

For defenders, this changes the question fundamentally. Detecting Emotet matters — but detecting Emotet before it delivers TrickBot matters more. And detecting the behavioural chain that allows any initial access to become a larger intrusion matters most of all. Hash matching and domain blocklists answer the first question. Behavioral detection answers the second and third.

The 2021 takedown was real and significant. Emotet returned anyway — variants were observed as early as late 2021, with renewed activity through 2022 and into 2023. The same lesson from QakBot and Duck Hunt applies here: infrastructure seizures without prosecution of operators are delays, not endings.

SOURCES

MITRE ATT&CK — S0367 — Emotet: Tactics, techniques, and associated groups -> https://attack.mitre.org/software/S0367/

CISA & MS-ISAC — Alert AA20-280A: Emotet Malware (October 6, 2020) -> https://www.cisa.gov/news-events/alerts/2020/10/06/emotet-malware

U.S. Department of Justice — Emotet Botnet Disrupted in International Cyber Operation (January 28, 2021) -> https://www.justice.gov/opa/pr/emotet-botnet-disrupted-international-cyber-operation

Europol — World's Most Dangerous Malware Emotet Disrupted Through Global Action (January 27, 2021) -> https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action

HHS Health Sector Cybersecurity Coordination Center (HC3) — Emotet Sector Briefing — Emotet's role in the broader cybercriminal ecosystem -> https://www.hhs.gov/sites/default/files/emotet.pdf

FBI — Emotet Malware (Technical Details and Indicators of Compromise) -> https://www.ic3.gov/Media/Y2020/PSA200922

Proofpoint Threat Research — Emotet is Back — Emotet 2021 resurgence analysis -> https://www.proofpoint.com/us/blog/threat-insight/emotet-is-back

SANS Internet Stormcenter — Emotet epoch infrastructure and C2 analysis -> https://isc.sans.edu/diary/Emotet+malware+infection/26752

The Record / Recorded Future — Emotet infrastructure overview and post-2021 resurgence tracking -> https://therecord.media/emotet-botnet-returns-after-months-long-hiatus

Chapter 1 — Origins and Timeline

The earliest documented cluster of Raspberry Robin activity traces to September 2021, though the malware wasn't publicly named until Red Canary's disclosure in May 2022. Microsoft tracks the actor operating it under the name Storm-0856, and the malware itself carries the internal identifier Roshtyak in reverse-engineering writeups from Avast.

In its first year, Raspberry Robin's purpose was genuinely unclear to defenders — it spread aggressively but appeared to do little else. That changed in July 2022, when Microsoft observed infected hosts being handed off to FakeUpdates (SocGholish), and later to Cobalt Strike, IcedID, Bumblebee, TrueBot, and eventually LockBit. The worm had become a delivery mechanism, not an end in itself.

Researchers have also flagged code-level and infrastructure overlaps between Raspberry Robin and Dridex, a malware family long associated with the Evil Corp threat group — one of several data points suggesting the operators sit close to established Eastern European cybercrime networks rather than being a new, unaffiliated crew.

Confidence check: unlike the CVE-2024-38196 privilege-escalation detail below, which is a confirmed technical fact, the Dridex/Evil Corp connection is an analyst assessment built on code and infrastructure overlap — not confirmed attribution. Worth holding those two kinds of claims to different evidentiary bars.

Chapter 2 — Infection Chain and Technical Mechanics

The classic infection path begins with a Windows shortcut (.lnk) file planted on a USB drive, disguised as a folder or named after the drive's own brand rather than a generic filename — MITRE ATT&CK T1091, Replication Through Removable Media. When a user opens it, the .lnk invokes legitimate Windows utilities — msiexec.exe, odbcconf.exe, or regsvr32.exe — to fetch and stage an encrypted payload, an instance of T1218, Signed Binary Proxy Execution. Because autorun is disabled by default on modern Windows, the worm depends on the victim clicking into what looks like an ordinary folder.

This is a living-off-the-land approach almost by design: every binary doing the fetching and executing is signed, trusted, and already present on the host, which makes early-stage detection by static signature or binary reputation nearly useless.

Infection chain, end to end

The diagram below traces the path from the USB drop through privilege escalation to the point where Raspberry Robin's role ends and another crew's begins.

Once staged, Raspberry Robin injects into legitimate system processes — rundll32.exe, dllhost.exe, and regsvr32.exe among them — to blend its runtime behavior into normal process trees (T1055, Process Injection). Recent variants add local privilege escalation, most notably exploitation of CVE-2024-38196, a Common Log File System (CLFS) driver vulnerability that yields SYSTEM privileges, alongside a UAC bypass technique that abuses fodhelper.exe to run elevated commands without triggering a consent prompt (T1548.002, Bypass User Account Control).

Persistence is handled through unremarkable means — registry Run and RunOnce keys (T1547.001), and occasionally scheduled tasks (T1053) — chosen precisely because they rarely stand out in isolation.

Note: the payload DLL itself stays encrypted until a live command-and-control handshake completes. This is a deliberate anti-analysis measure — a sandboxed sample with no network egress often can't be unpacked at all, which is part of why early write-ups of this malware took so long to converge.

Chapter 3 — Obfuscation and Anti-Analysis

Raspberry Robin's packer stack is unusually deep for commodity malware — public analysis has documented as many as fourteen layers of packing in a single sample, and later iterations added a five-stage protection chain: a first-stage packer, a shellcode loader, a second-stage loader DLL, intermediate shellcode, and a final shellcode downloader. Each layer exists to slow down both automated sandboxes and human reverse engineers.

The malware is also known to deploy decoy or non-functional payloads when it detects a sandbox or analysis environment, a tactic aimed squarely at wasting analyst time and polluting detection pipelines with false conclusions.

Chapter 4 — Infrastructure

Raspberry Robin's command-and-control backbone runs substantially through compromised QNAP network-attached storage devices — legitimate small-business and home-office hardware repurposed without their owners' knowledge. Communication over this layer has been observed on port 8080 (T1071, Application Layer Protocol; T1571, Non-Standard Port). Layered on top of the NAS-based nodes are fast-flux DNS rotation (T1568.001) and Tor-routed traffic (T1090.003), both of which make simple IP or domain block listing an unreliable defense.

By 2024–2025, distribution had diversified well past USB media. Campaigns increasingly relied on phishing lures, malvertising, and abuse of trusted cloud platforms such as Discord's content delivery network — infrastructure defenders are far less likely to block wholesale.

Chapter 5 — From Worm to Initial Access Broker

The most important shift in Raspberry Robin's story isn't technical — it's organizational. What began as a worm with no clear monetization path is now a resilient access-brokerage layer sitting between compromise and impact. It has been observed handing off to SocGholish (itself frequently a pre-ransomware signal), to Truebot, Bumblebee, and IcedID as second-stage loaders, and downstream to LockBit ransomware operations.

This division of labor is the point. The crew running Raspberry Robin doesn't need to operate a ransomware program, negotiate with victims, or launder payments — they sell or hand off footholds to whoever is positioned to monetize them. That specialization is the subject of Chapter 7.

Chapter 6 — Defensive Strategy

“Install AV” was never a serious answer to Raspberry Robin, and it still isn't. A worm that lives in trusted binaries, encrypted payloads, and NAS-based C2 needs a defense built in layers, not a single control. The following areas matter, roughly in the order a SOC should mature them.

Endpoint

Restrict autorun and autoplay policy centrally rather than relying on the Windows default, since many organizations have re-enabled it through legacy Group Policy — this is the direct control against T1091. Constrain or monitor msiexec.exe, odbcconf.exe, and regsvr32.exe when they're invoked with network-fetching arguments (T1218) — these are the exact LOLBins Raspberry Robin depends on. Application control (WDAC or equivalent) that restricts execution from removable media is one of the highest-leverage single controls against this family specifically.

Network

Egress filtering and DNS monitoring matter more than perimeter blocklists here, since the C2 layer rotates through compromised NAS devices and fast-flux domains (T1568.001, T1071, T1090.003). Watch for outbound connections on non-standard ports (T1571) from endpoint processes that have no legitimate reason to reach the internet directly, and flag Tor-adjacent traffic patterns from workstation subnets rather than just server segments.

Identity

Because the CLFS privilege-escalation path and UAC bypass technique (T1548.002) both aim at turning a standard user session into SYSTEM, identity hardening — least privilege, local admin removal, and credential-tiering — reduces the blast radius even when initial execution succeeds.

User awareness

The initial vector is still, fundamentally, someone plugging in a drive and opening what looks like a folder. Awareness training that specifically addresses unknown removable media — not generic phishing training — closes a gap that technical controls alone don't fully cover.

Logging

Process creation logging (Sysmon Event ID 1) with full command-line capture is close to non-negotiable for this family, given how much of the infection chain hides inside legitimate process names. Pair it with image-load and network-connection logging to catch the injection (T1055) and C2 stages, and registry-modification logging to catch T1547.001 persistence.

EDR

Behavioral detection — flagging unusual child-process relationships from rundll32.exe, dllhost.exe, or regsvr32.exe (T1055), or unexpected network activity originating from those processes — catches Raspberry Robin far more reliably than static signatures ever will, given the packing depth described in Chapter 3.

SOC playbooks

A Raspberry Robin playbook should assume the alert is an initial-access event, not an isolated infection, and treat it with the urgency of a pre-ransomware indicator. Isolation, credential rotation for the affected host, and a hunt for lateral movement should be default steps, not escalation-dependent ones.

Detection maturity

Public Sigma rule sets mapped to MITRE ATT&CK exist for this family and are a reasonable starting baseline, but given how quickly the packer and loader chain iterates, treat imported rules as a floor to tune against your own environment's telemetry, not a finished detection program.

Chapter 7 — Lessons Learned

This chapter isn't really about Raspberry Robin. It's about what Raspberry Robin is a symptom of.

Why are loaders replacing monolithic malware?

A single piece of malware that does reconnaissance, evasion, persistence, and payload delivery all in one binary is a single point of failure — for the defender to detect, and for the operator to maintain. Splitting that into a lightweight, disposable loader plus a separately maintained payload lets the loader be rebuilt and re-packed constantly while the more valuable payload code stays untouched. Raspberry Robin's five-layer loader chain isn't complexity for its own sake; it's a firewall between the disposable delivery mechanism and the asset actually worth protecting from analysis.

Why are Initial Access Brokers becoming important?

Gaining a foothold in a corporate network and monetizing that foothold are different skill sets — one is about evasion and delivery, the other about extortion, negotiation, and laundering. Raspberry Robin's operators appear to specialize in the former and sell or hand off to whoever specializes in the latter. This isn't a new idea in crime generally, but it has matured quickly in cyber: access is now a product with its own supply chain, priced and traded somewhat independently of what happens after the handoff.

How is cybercrime becoming specialized?

Raspberry Robin sits inside an ecosystem where distinct crews each own one stage: initial access, loader development, credential theft, ransomware deployment, negotiation, and laundering. The apparent links to Dridex-adjacent infrastructure suggest some of this specialization runs through long-standing groups rather than being purely new entrants. For defenders, the practical implication is that a Raspberry Robin alert is never really about Raspberry Robin — it's an early signal in someone else's supply chain, and the appropriate response is to treat it as a leading indicator of whatever comes next, not as the incident in isolation.

That, more than any single technical detail in the chapters above, is the case for building detection maturity around behavior and infrastructure patterns rather than static indicators. The indicators will keep changing. The economics driving the specialization won't.

References

ANY.RUN. “Raspberry Robin Malware Analysis, Overview.” any.run/malware-trends/raspberryrobin/

eSentire Threat Response Unit. “Threat Intelligence Malware Analysis: Raspberry Robin.” esentire.com/blog/esentire-threat-intelligence-malware-analysis-raspberry-robin

Picus Security. “Raspberry Robin Malware in 2025: From USB Worm to Elite Initial Access Broker.” picussecurity.com/resource/blog/raspberry-robin-malware-in-2025-from-usb-worm-to-elite-initial-access-broker

Check Point Software. “Raspberry Robin Malware: A Worm Weaponizing USBs.” checkpoint.com/cyber-hub/threat-prevention/what-is-malware/raspberry-robin-malware/

Sentenac, Alexandra. “Darktrace's Investigation of Raspberry Robin Worm.” Darktrace, darktrace.com/blog/the-early-bird-catches-the-worm-darktraces-hunt-for-raspberry-robin

Microsoft Security Blog. “Raspberry Robin Worm Part of Larger Ecosystem Facilitating Pre-Ransomware Activity.” microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/

Dark Reading. “Raspberry Robin Worm Hatches a Highly Complex Upgrade.” darkreading.com/threat-intelligence/raspberry-robin-worm-highly-complex-upgrade

SOC Prime. “Raspberry Robin Malware Detection: New Connections Revealed.” socprime.com/blog/raspberry-robin-malware-detection-new-connections-revealed/

FourCore. “Raspberry Robin Worm Infecting Hundreds of Windows Networks — Detection Sigma Rules.” fourcore.io/blogs/raspberry-robin

SigmaHQ. “Main Sigma Rule Repository.” github.com/SigmaHQ/sigma

![](file:///C:/Users/Alka/AppData/Local/Temp/msohtmlclip1/01/clip_image001.gif align="center")

On August 29, 2023, the U.S. Department of Justice announced what it called the largest U.S.-led financial and technical disruption of a botnet infrastructure in history. Operation Duck Hunt, a multinational effort spanning seven countries, had successfully seized QakBot's command-and-control infrastructure, pushed an uninstaller to over 700,000 infected machines, and seized $8.6 million in cryptocurrency from QakBot's operators.

Four months later, QakBot was back.

That single fact is the most important thing Operation Duck Hunt teaches us. Not that the FBI failed — the operation was technically remarkable by any measure. But that infrastructure takedowns, however sophisticated, are temporary by design when the people behind the malware remain free and the criminal business model remains intact.

From Banking Trojan to Criminal Infrastructure

QakBot first appeared in 2008 as a relatively straightforward banking trojan. Its early purpose was credential theft — harvesting usernames, passwords, session cookies, and credit card data from infected machines to enable financial fraud. That original design persisted for years, making QakBot a persistent but fairly unremarkable entry in the threat landscape.

What changed — and what made QakBot genuinely dangerous — was its evolution into an Initial Access Broker (IAB). Rather than conducting attacks itself, QakBot increasingly sold the footholds it established to other threat actors: ransomware groups who would purchase access to an already-compromised corporate network and deploy their own payloads weeks or months after the initial infection.

By 2023 it had become the delivery mechanism of choice for some of the most destructive ransomware operations on record, including Conti, REvil, Black Basta, Egregor, ProLock, and MegaCortex. QakBot itself rarely caused the final damage. It held the door open for whoever paid.

From Banking Trojan to Criminal Infrastructure

QakBot first appeared in 2008 as a relatively straightforward banking trojan. Its early purpose was credential theft — harvesting usernames, passwords, session cookies, and credit card data from infected machines to enable financial fraud. That original design persisted for years, making QakBot a persistent but fairly unremarkable entry in the threat landscape.

What changed — and what made QakBot genuinely dangerous — was its evolution into an Initial Access Broker (IAB). Rather than conducting attacks itself, QakBot increasingly sold the footholds it established to other threat actors: ransomware groups who would purchase access to an already-compromised corporate network and deploy their own payloads weeks or months after the initial infection.

By 2023 it had become the delivery mechanism of choice for some of the most destructive ransomware operations on record, including Conti, REvil, Black Basta, Egregor, ProLock, and MegaCortex. QakBot itself rarely caused the final damage. It held the door open for whoever paid.

From Banking Trojan to Criminal Infrastructure

QakBot first appeared in 2008 as a relatively straightforward banking trojan. Its early purpose was credential theft — harvesting usernames, passwords, session cookies, and credit card data from infected machines to enable financial fraud. That original design persisted for years, making QakBot a persistent but fairly unremarkable entry in the threat landscape.

What changed — and what made QakBot genuinely dangerous — was its evolution into an Initial Access Broker (IAB). Rather than conducting attacks itself, QakBot increasingly sold the footholds it established to other threat actors: ransomware groups who would purchase access to an already-compromised corporate network and deploy their own payloads weeks or months after the initial infection.

By 2023 it had become the delivery mechanism of choice for some of the most destructive ransomware operations on record, including Conti, REvil, Black Basta, Egregor, ProLock, and MegaCortex. QakBot itself rarely caused the final damage. It held the door open for whoever paid.

Infection Chains: How QakBot Got In

QakBot's delivery mechanisms evolved significantly over its lifespan, consistently adapting to whatever defensive changes Microsoft and the security industry introduced.

Email thread hijacking

One of QakBot's most effective and underappreciated tactics was injecting malicious replies into real stolen email conversations. By compromising a mailbox and responding to an existing thread with a malicious attachment, attackers bypassed the usual suspicion around cold phishing. The victim received what appeared to be a reply from a known contact in an ongoing conversation.

Macro documents, then the pivot

For years, QakBot relied on malicious Office macros embedded in Word or Excel attachments. When Microsoft disabled macros by default in 2022 — arguably one of the most impactful defensive changes of that decade — QakBot pivoted almost immediately. Within months it was distributing payloads via OneNote files with embedded scripts, HTML smuggling, and ISO attachments containing malicious executables. The speed of adaptation was notable.

DLL sideloading and execution

Once a victim executed the initial payload, QakBot would inject a malicious DLL into a legitimate Windows process. This technique — process injection — allowed QakBot to run entirely within the memory space of trusted system processes, making it invisible to file-based detection and difficult to identify in a process listing without behavioral context.

What Happened After Execution

QakBot's post-execution behavior was designed around stealth and persistence rather than immediate visible impact. The malware would typically remain dormant after initial compromise, establishing persistence while waiting for operator instructions. This dormancy period is one reason infections were frequently overlooked until a ransomware deployment made them impossible to ignore.

1     Persistence via Registry Run Keys

QakBot established persistence under HKCU\SOFTWARE\Microsoft\ with randomized key names, ensuring it survived reboots while blending into the registry noise of a typical Windows installation.

2     Process injection into legitimate Windows processes

QakBot injected its DLL into legitimate processes including wermgr.exe and AtBroker.exe. Running inside a trusted process meant its network activity appeared to originate from a legitimate Windows component.

3     C2 communication via three-tier proxy infrastructure

Rather than connecting directly to attacker-controlled servers, QakBot used a three-tier C2 architecture. Tier 1 supernodes were ordinary infected machines promoted to relay traffic. Tier 2 acted as upstream proxies. Tier 3 was the actual operator-controlled server. As of June 2023, 853 supernodes were active across 63 countries.

4     Credential and data collection

QakBot scanned infected hosts for credentials, browser cookies, financial data, and email content, exfiltrating findings back through the tiered C2 chain.

5     Access brokerage — selling the foothold

Established access was sold or rented to ransomware affiliates, who would conduct their own reconnaissance and deploy their payload independently, often weeks after the initial QakBot infection.

![](file:///C:/Users/Alka/AppData/Local/Temp/msohtmlclip1/01/clip_image005.gif align="center")

![](file:///C:/Users/Alka/AppData/Local/Temp/msohtmlclip1/01/clip_image006.gif align="center")

DETECTION NOTE

The three-tier C2 model is particularly significant for defenders. Network connections from a process like wermgr.exe to residential IP ranges — rather than known corporate infrastructure — are a reliable behavioral indicator. QakBot's supernodes changed frequently to evade blocklists, but the pattern of encrypted HTTPS traffic from injected system processes to unusual destinations persists across variants.

Operation Duck Hunt: What the FBI Actually Did

The mechanics of Operation Duck Hunt are worth understanding in detail, because they represent a genuinely novel approach to botnet disruption — and because understanding what it accomplished makes clear why it wasn't permanent.

1     Gaining access to QakBot's admin infrastructure

The FBI identified and gained lawful access to servers running QakBot's botnet infrastructure, including systems used by QakBot administrators. This included QakBot's internal testing stack — virtual machines used to check malware samples against antivirus engines before deployment.

2     Obtaining QakBot's encryption keys

With access to the admin systems, investigators obtained the encryption keys used to protect QakBot's command communications. This allowed them to decode and understand the botnet's encrypted traffic in real time.

3     Replacing the supernode module

Using those encryption keys, the FBI instructed Tier 1 supernodes to replace their QakBot supernode module with an FBI-developed module carrying new encryption keys — locking the QakBot administrators out of their own infrastructure. This began on August 25, 2023, at 7:27 PM ET.

4     Redirecting botnet traffic to FBI servers

Once infected machines checked in — every one to four minutes — they found themselves communicating with FBI-controlled servers instead. The transition was seamless from the victim machine's perspective.

5     Pushing the uninstaller

The FBI used QakBot's own update mechanism to deliver a legitimate removal tool to infected machines, severing their connection to the botnet and removing the QakBot malware from system memory. 52 servers were seized across the operation. $8.6 million in cryptocurrency was recovered.

IMPORTANT CAVEAT

CISA explicitly noted that the scope of the operation was limited to malware installed by QakBot actors. It did not remediate other malware already present on victim machines — meaning ransomware already deployed, secondary payloads already dropped, or credentials already exfiltrated were entirely outside the operation's reach. Machines cleaned of QakBot were not necessarily clean.

Why QakBot Came Back

The critical detail that Operation Duck Hunt's press releases did not emphasize: nobody was arrested. The administrators behind QakBot — the developers, the operators, the affiliate managers — remain unidentified or at large. Infrastructure was seized. The people who built and ran it were not.

By October 2023, Cisco Talos had identified phishing campaigns from QakBot affiliates — suggesting the operation had not affected QakBot's spam delivery infrastructure, only its C2 servers. By December 2023, Microsoft reported a new QakBot campaign targeting the hospitality industry, distributing a new 64-bit variant (version 0x500) with improved AES encryption and updated anti-analysis routines including VM detection. By early 2024, affiliate networks were ramping up again following familiar seasonal patterns.

This mirrors what happened with Emotet, disrupted in January 2021 and operational again by November of the same year, and with TrickBot, which survived multiple takedown attempts. The pattern is consistent: seize the infrastructure, the operators rebuild. The only disruption that permanently ends a criminal operation is prosecution of the people running it.

What the affiliates did in the gap

QakBot's affiliate network didn't sit idle after Duck Hunt. Within weeks, groups like TA577 had pivoted to distributing DarkGate, IcedID, and PikaBot as replacement loaders. Black Basta — one of QakBot's most prolific ransomware customers — went quiet for September 2023, then resumed claiming victims in

mid-October. The criminal ecosystem adapted. It always does.

Detection Engineering Notes

Because QakBot's file hashes and C2 domains rotate constantly, durable detection requires focusing on the behavioral patterns that persist across variants.

MITRE ATT&CK; coverage

Closing thoughts

Operation Duck Hunt was a genuine achievement. The technical sophistication required to obtain encryption keys, lock operators out of their own infrastructure, and use the botnet's own update mechanism to deliver a removal tool is remarkable. The international coordination across seven countries and multiple private sector partners represented law enforcement operating at the frontier of what's technically possible.

And yet QakBot was back within four months.

The lesson isn't that the FBI failed. It's that the current model of botnet disruption — seize the infrastructure, clean the victims, recover the cryptocurrency — is fundamentally a temporary measure when no arrests follow. QakBot's administrators rebuilt because they could. The criminal business model remained profitable. The technical knowledge remained intact. The people remained free.

For defenders, the implication is straightforward: don't retire QakBot detection rules because of a takedown. The affiliates pivot, the variants update, and the behavioral patterns that matter — process injection into legitimate Windows processes, tiered C2 through residential IPs, dormant persistence waiting for a ransomware payload — persist across every iteration.

SOURCES

U.S. Department of Justice — Qakbot Malware Disrupted in International Cyber Takedown (August 29, 2023)

https://www.justice.gov/usao-cdca/pr/qakbot-malware-disrupted-international-cyber-takedown

FBI — FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown (August 29, 2023)

https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown

CISA & FBI — Joint Cybersecurity Advisory AA23-242A: Identification and Disruption of QakBot Infrastructure (August 30, 2023)

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a

TechCrunch — How the FBI took down the notorious Qakbot botnet (September 1, 2023)

https://techcrunch.com/2023/09/01/fbi-qakbot-takedown-operation-duck-hunt/

Microsoft Threat Intelligence — New QakBot campaign targeting the hospitality industry (December 15, 2023)

https://thehackernews.com/2023/12/qakbot-malware-resurfaces-with-new.html

Red Canary Threat Detection Report — Qbot — post-takedown affiliate activity and resurgence analysis

https://redcanary.com/threat-detection-report/threats/qbot/

BankInfoSecurity / Sophos — More Signs of a Qakbot Resurgence (February 2024)

https://www.bankinfosecurity.com/more-signs-qakbot-resurgence-a-24352

KELA Cyber — Surviving the QakBot Takedown: Black Basta and Knight Ransomware Operations (November 2023)

https://www.kelacyber.com/blog/surviving-the-qakbot-takedown-black-basta-and-knight-ransomware-operations/

Picus Security — CISA Alert AA23-242A: Operation Duck Hunt — Taking Down QakBot Botnet

https://www.picussecurity.com/resource/blog/cisa-alert-aa23-242a-operation-duck-hunt-taking-down-qakbot-botnet

Huntress — Qakbot Malware Takedown and Defending Forward (August 30, 2023)

https://www.huntress.com/blog/qakbot-malware-takedown-and-defending-forward

MITRE ATT&CK; — QakBot software page — tactics, techniques, and associated groups

https://attack.mitre.org/software/S0650/

Forget zero-days. LummaC2 doesn't need one. It asks you to press three keys -- and you launch it yourself. This is the anatomy of one of 2025's most active infostealers, seen through a defender's lens.

What even is LummaC2?

LummaC2 is a Malware-as-a-Service (MaaS) infostealer -- meaning anyone with enough cryptocurrency and bad intent can rent it. Operators purchase access, configure what to steal, and deploy campaigns at scale without ever writing a line of malware code themselves.

Its power isn't technical sophistication. It's a ruthlessly modular design paired with a social engineering trick so simple it's almost embarrassing: it asks the victim to do all the work.

The ClickFix Attack: Three keystrokes to compromise

The ClickFix technique is the infection vector that made Lumma dominant. Instead of silently exploiting a browser vulnerability, it exploits something much harder to patch: human trust.

DETECTION OPPORTUNITY

Watch for powershell.exe spawning immediately after browser activity or Windows Run dialog usage. This behavior is unusual and can be caught with process-lineage monitoring -- even when the file hash is completely unknown.

From a detection engineering perspective, this is a textbook 'living off the land' technique. No suspicious binaries dropped at rest. No exploit shellcode. Just Windows doing exactly what it was designed to do -- at the attacker's direction.

Inside the malware: six execution stages

Once active, Lumma doesn't spray and pray. It behaves like a well-engineered application, moving through distinct stages with a clean separation between delivery and instruction -- making it adaptable across campaigns.

ANALYST NOTE: THE DEVELOPER FAILSAFE

Lumma checks the victim's username and computer name by hashing them and comparing against two hardcoded values. If they match -- likely the developer's own machine -- the malware terminates immediately. The algorithm is one-way, so analysts cannot reverse it to learn the attacker's own credentials. A deliberate, professional engineering choice.

Why session cookies are worth more than passwords

Most people think credential theft means stealing passwords. Lumma knows better. The real prize in 2025 is the authenticated session cookie.

This is why modern phishing-resistant MFA matters. Standard TOTP codes do not protect against session hijacking -- the attacker never needs to authenticate, because the session already is authenticated.

What else can it steal? The opcode menu

Lumma's C2 sends JSON configurations with opcodes that tell it exactly what to do. Think of it as a task list the operator updates per campaign:

ANALYST NOTE: SERVER-SIDE FLEXIBILITY

Because behavior is configured server-side, no two Lumma infections look the same. One campaign may only steal cookies. Another adds screenshot capability and drops a secondary payload. Traditional signature-based detection fails here entirely -- you need behavioral monitoring, not hash matching.

MITRE ATT&CK mapping

Lumma maps cleanly to documented MITRE techniques -- useful for validating and stress-testing your existing detection coverage:

How to actually defend against this

IOCs -- domains, hashes -- are burned the moment they're published. Lumma rotates them constantly. The only durable defense is behavioral. Here's what the FBI and CISA recommend, and why each one works:

THE DEFENDER'S MINDSET SHIFT

Stop chasing what Lumma looks like. Start watching how it behaves. Domains rotate. Hashes change. But 'a process accessed browser credential storage and immediately initiated external network communication' is a behavioral pattern that persists across every variant -- and that's where your detections need to live.

The bottom line

LummaC2 isn't remarkable because of what it does technically. It's remarkable because it combined social engineering, a modular MaaS architecture, and session cookie theft into a scalable platform that thousands of low-sophistication threat actors can deploy effectively. The ClickFix technique bypasses every perimeter control by simply asking the user to be the exploit. Your EDR can't flag a user pressing Win+R. Your firewall can't block PowerShell that the user themselves launched. The detection surface has shifted -- and defenders still matching IOCs are already behind.

Sources: FBI & CISA Joint Cybersecurity Advisory AA25-141B (May 21, 2025) · Microsoft Threat Intelligence -- Lumma disruption and ecosystem analysis (May 2025) · MITRE ATT&CK Enterprise Framework v17 · ReliaQuest contribution acknowledged in advisory