emotet_operators · threatengine.sh

Emotet Operators (also tracked as Mealybug per ESET / Eurojust / Europol canonical naming, TA542 per Proofpoint, MUMMY SPIDER per CrowdStrike, GOLD CABIN per SecureWorks.

signature malware family also referred to as Geodo, Heodo, or historical Feodo lineage) is a Russia-speaking organized cyber-criminal cluster financially-motivated, active publicly since June 2014 , one of the most operationally consequential and longest- running organized cyber-criminal clusters tracked across modern cyber-threat-intelligence history. The cluster's signature malware family (Emotet) is operationally cluster- defining, the cluster is consistently identified across industry vendor reporting by the signature malware family, and the cluster's operational identity is fundamentally tied to the Emotet malware-loader operational capability. Operational phases of the cluster's longitudinal history: (1) BANKING TROJAN ERA (2014-2017). Foundational operational era as a banking trojan targeting German banking customers (signature 2014 initial geography) via Microsoft Word documents with embedded malicious VBA macros distributed through spam email campaigns. The earliest Emotet variants focused on JSON-formatted browser-injection capability for capturing online-banking credentials, cookies, and credit-card data. The cluster operationally expanded targeting geography across Western and Northern European banking customers (Austria, Switzerland, Netherlands, France, Italy) through 2014-2016 before evolving into the loader-as-a-service operational model that subsequently dominated operations. (2) LOADER-AS-A-SERVICE OPERATIONAL TRANSITION (2017-2018). Operational transition from banking-trojan-only operations toward the loader-as-a-service operational model. Mealybug operators re-architected Emotet as a modular malware loader with dynamic plugin capability supporting follow-on payload delivery. The cluster began monetizing the operational capability by selling access-to-compromised-hosts to other organized-cybercrime operators via the malware-as-a-service business model, operationally pioneering the modern loader-as-a-service model that subsequently became dominant across the Russia-speaking-organized-cybercrime ecosystem.

(3) TRICKBOT

RYUK / CONTI FLAGSHIP RANSOMWARE AFFILIATE CHAIN ERA (2018-2020). The cluster operationally established the Emotet.
TrickBot.
Ryuk-then-Conti ransomware affiliate chain as the modern era's most operationally consequential organized-cybercrime malware-deployment chain. The chain drove hundreds of high-value enterprise ransomware compromises across United States, Europe, Canada, Australia, and broader Western economies, generating cumulative ransom payments estimated in the hundreds of millions of dollars. The operational partnership relationships with the Wizard Spider / TrickBot / Conti ecosystem (curated separately in this corpus as wizard_spider_conti.yaml) were operationally defining for both clusters during this era. Check Point data from this era indicated that Emotet potentially affected one out of every five organizations worldwide. Europol publicly characterized Emotet as "the world's most dangerous malware." (4) EUROPOL/EUROJUST INTERNATIONAL TAKEDOWN AND OPERATIONAL QUIET PERIOD (January-November 2021). On January 27, 2021, Europol and Eurojust coordinated an international multi-agency takedown of Emotet infrastructure involving cybersecurity authorities and law enforcement from the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada, and Ukraine. The operation achieved takeover of several hundred Emotet C2 servers worldwide, Ukrainian SBU and Ukrainian National Police arrests at Emotet-operator- affiliated locations in Ukraine, and deployment of a custom uninstaller via the Emotet botnet's own command channel scheduled for delivery on April 25, 2021 to systematically remove Emotet malware from victim machines. The January 2021 Emotet takedown was the largest international law-enforcement takedown of a malware operation in history at the time and operationally established the precedent that subsequently informed the August 2023 FBI Operation Duck Hunt Qakbot takedown (curated separately as qakbot_operators.yaml). (5) OPERATIONAL RESURGENCE AND POST-TAKEDOWN ADAPTATION (November 2021.
April 2023). On November 14, 2021, new Emotet samples emerged that were very similar to the previous pre-takedown bot code but with operational improvements including a different encryption scheme using elliptic curve cryptography (ECC) for command-and-control communications. The resurgence was distributed via TrickBot to computers previously infected with TrickBot, confirming that the cluster's operational coordination with the broader Wizard Spider / TrickBot ecosystem had survived the takedown. Within days the resurfaced operations rapidly rebuilt the spam-botnet capability and resumed malicious spam email distribution. The November 2021 resurgence operationally demonstrated that infrastructure-disruption law-enforcement operations alone are insufficient for permanent operational defeat absent operator-membership prosecution. Following Microsoft's February 2022 announcement that VBA macros would be disabled by default in Office applications, the cluster experimented with alternative initial-access tradecraft including LNK files (April-July 2022), XLL Excel add-ins (October 2022 onward), Microsoft OneNote files (early 2023), and 64-bit-architecture Emotet samples (November 2022 onward). ESET tracking documented three distinctive 2023 malspam campaigns each testing different intrusion avenues. (6) EXTENDED QUIET PERIOD AND POST-EMOTET LOADER ECOSYSTEM (April 2023.
Present). The cluster's last publicly-documented Emotet spam campaign concluded approximately April 2023, and the cluster has remained in an extended operational quiet period since. The post-April-2023 quiet period has been longer than the cluster's typical historical operational quiet-period rhythm (2-3 months of active campaigns followed by 3-12 months offline) and may reflect operational difficulty finding new initial-access tradecraft as effective as the pre-2022 VBA-macros tradecraft. The broader loader-as-a- service ecosystem has continued operating during this period through other loader families including IcedID, Pikabot (operationally related to Qakbot), DarkGate, Bumblebee, Hijack Loader, and others.

Signature operational tradecraft includes

High-volume email-spam-distribution capability via compromised-host spambot relay (signature: Emotet-infected machines acted as spambot relays sending a dozen or more Emotet-distribution emails per minute, enabling thousands of Emotet emails per host per day and hundreds of thousands of emails per day across the active botnet).
Signature email-thread-hijacking tradecraft: Emotet operationally harvested email from infected machines and then sent Emotet-distribution emails as legitimate-appearing replies to actual past email threads from the infected machine, operationally devastating for social-engineering effectiveness because targeted victims received Emotet emails appearing to be legitimate replies from known correspondents within actual email threads.
Multi-format weaponized attachments across operational eras: Microsoft Word with VBA macros (2014-2022 signature), Excel with VBA macros, LNK shortcut files (post-2022 era), XLL Excel add-ins (October 2022 onward), Microsoft OneNote files (early 2023), and broader file-format diversification following the Microsoft macro-disable 2022.
Sophisticated multi-epoch C2 infrastructure: Emotet operationally maintained separate C2 epochs (Epoch 1 through Epoch 5 across the cluster's operational history) providing operational resilience and concealment of the main C2 backend.
Registry-Run-Key persistence (T1547.001) and Windows Service persistence (T1543.003) signature persistence patterns.
Modular plugin-based architecture enabling dynamic capability loading without requiring full malware updates, operationally distinguishes Emotet from competing organized- cybercrime malware families.
Anti-analysis and anti-VM/sandbox tradecraft sophisticated across the cluster's operational history with continuous updates following endpoint-detection-and-response platform capability changes.
Post-2022 obfuscation refinements including control flow flattening (operationally significant analysis-resistance technique), randomization of structure-member ordering, randomization of constant-calculation instructions (constants masked), and timer-queue-based callback function execution combined with control flow flattening. The cluster is operationally significant as the modern era's canonical loader-as-a-service operator across approximately a decade of operational continuity, with documented direct operational role in hundreds of ransomware deployments via the Emotet.
TrickBot.
Ryuk-Conti chain, peak operational scale of one of the largest spam botnets ever observed (with Check Point estimating that Emotet potentially affected one out of every five organizations worldwide at peak), and operational continuity through one major international law- enforcement takedown (January 2021) followed by a successful operational resurgence (November 2021). The January 2021 Europol/Eurojust takedown operation is one of the most operationally significant law-enforcement takedown operations against organized-cybercrime malware operations in modern cyber-threat-intelligence history, alongside the August 2023 FBI Operation Duck Hunt Qakbot takedown (curated separately as qakbot_operators.yaml). The two takedown operations together operationally demonstrated that international multi- agency law-enforcement coordination can disrupt operationally- productive Russia-speaking-organized-cybercrime malware operations even in the absence of complete operator-membership prosecution, though the post-takedown continuing operations observed for both Emotet (November 2021 onward through April 2023) and Qakbot (September 2023 onward) demonstrate that infrastructure disruption alone is insufficient for permanent operational defeat absent comprehensive operator-membership prosecution.

Emotet Operators

Profile

Aliases

MITRE ATT&CK aliases

Notable Campaigns

Attribution & Reporting

Operational

Techniques Used

Detection Blind Spots

Atomic Test Plan

Tools Used

CVEs Exploited