It turned out that someone replaced the malware loaded on the website with a harmless GIF animation
Emotet, which is extremely infectious and spreads and causes various malware infections when downloaded to a PC, has been regarded as a problem in recent years due to the extent of its damage. It has been reported that this Emotet malware file has been replaced with a GIF animation that is harmless to anyone.
Emotet being hijacked by another actor | by Kevin Beaumont | Jul, 2020 | DoublePulsar
A vigilante is sabotaging the Emotet botnet by replacing malware payloads with GIFs | ZDNet
Mystery actor disrupts Emotet malware distribution botnet-Security-iTnews
'Emotet' is a Trojan horse malware that uses spam emails. The user's PC that downloaded Office files etc. from the link of the mail is infected with ransomware 'Ryuk', and all files on the PC are encrypted. In 2019, almost all systems in Lake City in the United States were hijacked, resulting in a ransom payment of approximately 54 million yen.
An American municipality that paid ransom of 54 million yen for ransomware dismissed one IT manager in the city-GIGAZINE
Emotet, which had caused serious damage and was regarded as a problem, had its activity reduced in 2020, but there are signs of reactivation such as 250,000 emails sent per day.
Emotet resurfaced in a massive campaign today after being quiet for several months.The new campaign sports longtime Emotet tactics: emails carrying links or documents w/ highly obfuscated malicious macros that run a PowerShell script to download the payload from 5 download links pic.twitter. com/FZJqDCJQGV— Microsoft Security Intelligence (@MsftSecIntel) July 17, 2020
Meanwhile, a strange movement was seen around Emotet. According to Microsoft cybersecurity researcher Kevin Beaumont, the malware files distributed by Emotet have been rewritten by somebody into animated GIFs. This protects users from malware infections.
Mr. Beaumont discovered in 2019 that an attacker using Emotet hacked the Wordpress website and replaced the file with malware and deceived the user, but somebody found the Emotet payload as follows: It seems that they are replacing it with a GIF like this.
GIF of actor James Franco and...
Hackerman and others appearing in the 80's-style action movie ' Can Fury '.
There is no change in the trend of #Emotet installation sites in Japan.— Tike (@tiketiketikeke) July 24, 2020
It has been replaced by the HACKERMAN gif. pic.twitter.com/efxnbfaGfc
The replacement of data started slowly, but one-fourth of the daily Emotet activities have been replaced, causing a great deal of damage to attackers. Attackers are also taking measures, but it is reported that the activity as a whole tends to calm down.
Joseph Rosen of Cryptolaemus, who tracks activity on the Emotet botnet, said: ``As Ivan (administrator of Emotet) faced technical difficulties, Emotet activity dropped significantly this week, doing almost nothing. you could, 'said she says .
In addition, it is unknown who is interfering with Emotet, and it is possible that it is not only the vigilante but also a rival malware group.
in Security, Posted by darkhorse_log