In February 2022, other researchers have reported Cobalt Strike deployment within 5 hours of an Emotet infection originating from the Epoch 5 botnet.In December 2021, researchers closely monitoring Emotet reported instances of the malware deploying the Cobalt Strike intrusion tool.

Historically, Emotet has installed malware such as Trickbot or Qakbot, which in turn have led to hands-on-keyboard adversaries and ransomware deployment.Emotet was disrupted in early 2021 but made a comeback in November 2021.We found Emotet, a former banking malware, now focused on loading or delivering follow-on malware.HereвЂ™s the latest from our TRU TeamвЂ¦ What did we find? We outline how we responded to the confirmed threat and what recommendations we have going forward. In TRU Positives, eSentireвЂ™s Threat Response Unit (TRU) provides a summary of a recent threat investigation. Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit вЂ“ the TRU team.

We have discovered some of the most dangerous threats and nation state attacks in our space вЂ“ including the Kaseya MSP breach and the more_eggs malware. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes. Adversaries donвЂ™t work 9-5 and neither do we.

How to install cobalt strike