Black Friday Tool Deals 2018 Ad Scan XML: Emotet’s Holiday Season Malware Campaign

As Black Friday and Cyber Monday approached in 2018, online shoppers weren’t the only ones gearing up for a busy season. Cybercriminals, particularly the operators behind the Emotet malware, were also preparing to capitalize on the increased online activity. ESET researchers detected a significant surge in Emotet spam campaigns coinciding with the Black Friday shopping rush, revealing a shift in tactics and a clear focus on exploiting holiday season vulnerabilities.

Emotet, known for its widespread and impactful spam operations, launched a massive campaign taking advantage of the heightened email traffic surrounding Black Friday. The malware, typically spread through malicious attachments or links in spam emails, adopted a new technique. Instead of the usual DOC or PDF files, this campaign utilized XML files disguised with a misleading .doc extension. This subtle change likely aimed to bypass some security filters and trick users into opening the infected files.

These seemingly innocuous XML.doc attachments were the gateway to a range of harmful payloads. Emotet served as a delivery mechanism for various banking trojans, including Ursnif, TrickBot, and IcedId, with IcedId being the most prevalent. IcedId, in turn, often downloaded Azorult (detected by ESET as Win32/PSW.Delf.OSF), a notorious information stealer capable of pilfering passwords, credit card details, and cryptocurrency wallet access. TrickBot also expanded its reach, adding more UK and German banks to its target list, aligning with the English and German language themes observed in the spam email subjects and content, as previously highlighted by ESET.

The geographical distribution of this Black Friday Emotet campaign revealed a strong concentration in Latin America. Mexico, Ecuador, and Argentina topped the list of affected countries, experiencing hundreds of thousands of detections. The United States also ranked among the top five targeted nations, with the UK and South Africa also featuring in the top ten, indicating a broad and global impact of this holiday-themed cyber threat.

To help security professionals and system administrators identify and mitigate these threats, ESET researchers provided a list of Indicators of Compromise (IoCs) associated with the Emotet payloads used in this Black Friday campaign:

Indicators of Compromise (IoCs)

Emotet payloads

PSW.Delf.OSF – AZORult

Staying informed about the latest cyber threats is crucial, especially during peak online shopping seasons. Subscribing to newsletters and security updates from reputable sources like ESET can provide valuable insights and proactive protection against evolving malware campaigns.

Related Articles

[ESET Research

DeceptiveDevelopment targets freelance developers

ESET Research

DeceptiveDevelopment targets freelance developers](/en/eset-research/deceptivedevelopment-targets-freelance-developers/ “DeceptiveDevelopment targets freelance developers”)

[ESET Research

PlushDaemon compromises supply chain of Korean VPN service

ESET Research

PlushDaemon compromises supply chain of Korean VPN service](/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/ “PlushDaemon compromises supply chain of Korean VPN service”)

[ESET Research

Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344

ESET Research

Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344](/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ “Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344”)