Log in Request a demo

Malware profile

Emotet

Also known as Geodo

Emotet is a modular Windows malware that began as a banking Trojan and became a loader, a tool that installs other malware such as banking Trojans or ransomware.

In short

Emotet is a modular Windows malware that began as a banking Trojan and became a loader, a tool that installs other malware such as banking Trojans or ransomware. It mostly arrives in phishing emails with malicious attachments or links. Law enforcement took control of its infrastructure in January 2021.

Last updated 8 October 2026

Profile MapMalware
  1. Names2names in public reportsEmotet · Geodo
  2. Techniques20ATT&CK techniques listedInitial Access · Execution · Persistence
  3. Infection Steps6in the delivery chainPhishing email · User opens it

In one minute

What it is
A modular Windows malware, first discovered in 2014, that works as a loader which installs other malware.
What it does
Arrives by phishing email, steals email data and saved passwords, spreads to other computers on the network and installs further malware such as banking Trojans or ransomware.
Who uses it
MITRE lists the group Wizard Spider as using it. Eurojust and Europol say it was offered for hire to other criminals. These government sources do not name an operator.
How it gets in
Phishing emails with Word documents or links, where the user may be asked to enable macros.
What to do first
Block risky attachments and macros at the email gateway, and restrict SMB traffic between workstations.

What it does

Europol and Eurojust describe Emotet as a service that was offered for hire. Other criminals paid to have their own malware installed on computers that Emotet had already infected. They say its infrastructure ran on several hundred servers worldwide, and that it was polymorphic, which means its code changed each time it was called up and could slip past antivirus tools that look for known code.

CISA reports that Emotet infections cost state, local, tribal and territorial governments up to $1 million per incident to clean up. The US Department of Justice says law enforcement identified about 1.6 million computers infected between 1 April 2020 and 17 January 2021, of which over 45,000 were in the United States.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
EmotetMITRE ATT&CK software S0367, CISA TA18-201A and AA20-280A, Eurojust and Europol, DOJ[1, 2, 3, 4, 5]
GeodoMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    It has been delivered in phishing emails that carry attachments.[1, 2, 3]

  • Phishing: Spearphishing Link T1566.002

    It has been delivered in phishing emails that carry links.[1, 2, 3]

Execution

  • User Execution: Malicious File T1204.002

    It relies on a user opening a malicious attachment.[1, 3]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    It has used Word documents with macros that run scripts to download more payloads.[1, 3, 4]

  • Command and Scripting Interpreter: PowerShell T1059.001

    It has used PowerShell to fetch its payload and extra tools such as Mimikatz.[1, 3, 7]

  • Windows Management Instrumentation T1047

    It has used WMI to start powershell.exe.[1, 3, 7]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    It has added its downloaded payload to the current user Run key to stay on the computer.[1, 2, 3]

  • Create or Modify System Process: Windows Service T1543.003

    It has created new services to stay on the computer.[1, 2, 3]

  • Scheduled Task/Job: Scheduled Task T1053.005

    It has stayed on the computer through a scheduled task.[1, 2, 3]

Stealth

  • Process Injection: Dynamic-link Library Injection T1055.001

    It has been seen injecting code into Explorer.exe and other processes.[1, 2, 3]

  • Obfuscated Files or Information: Software Packing T1027.002

    It has used custom packers to protect its payloads.[1, 3]

Credential Access

  • Brute Force: Password Guessing T1110.001

    It has used a hard-coded list of passwords to guess user accounts.[1, 2, 3]

  • OS Credential Dumping: LSASS Memory T1003.001

    It has dropped and run password grabber modules, including Mimikatz.[1, 3]

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    It has dropped modules that take passwords saved in web browsers.[1, 3]

Discovery

  • Account Discovery: Email Account T1087.003

    It has used a module that collects email addresses from Outlook.[1, 2, 3]

Collection

  • Email Collection: Local Email Collection T1114.001

    It has used a module that collects email data from Outlook.[1, 3]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    It has used the Admin$ share to move to other computers after guessing the local admin password.[1, 3]

  • Exploitation of Remote Services T1210

    It has been seen using an SMB exploit such as EternalBlue (MS17-010) to spread.[1, 3]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    It has used HTTP to talk to its command servers.[1, 3, 7]

  • Non-Standard Port T1571

    It has used HTTP over unusual ports as well as common web ports.[1, 3]

How it spreads

Emotet spreads mainly through phishing emails with malicious attachments or links. CISA says the emails use branding the recipient knows, and the infection starts when a user opens the link, a PDF or a macro-enabled Word document. Eurojust and Europol say the Word documents could prompt the user to enable macros. Once inside, CISA says Emotet tries to spread across the local network by guessing passwords and writing to shared drives, and its access to SMB can lead to the infection of entire domains. Its Outlook scraper takes names and email addresses from the victim's account and uses them to send more phishing emails.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Phishing email

    A malicious email arrives with an attachment or a link, using branding the recipient knows.[2]

  2. User opens it

    The infection starts when the user opens the link, the PDF or the macro-enabled Word document.[2]

  3. Download

    In the 2019 campaigns CERT-EU studied, the macro ran a PowerShell command through WMI. The command tried several URLs to download and run Emotet.[7]

  4. Persistence

    Emotet sets itself up to survive restarts, for example through registry keys, scheduled tasks or services, and injects code into running processes.[2]

  5. Spread

    Spreader modules collect passwords and email addresses. A credential enumerator looks for writable SMB shares or guesses account passwords, then writes Emotet onto the next system.[2]

  6. Command server

    Emotet reports the new infection to its command server, receives configuration data, downloads and runs files and uploads data.[2]

Timeline

  1. June 2014

    Emotet first emerges

    MITRE says Emotet first emerged in June 2014, at first targeting the financial sector. Eurojust and Europol say it was first discovered as a banking Trojan in 2014.[1, 4]

  2. 2017

    School district network disabled

    The US Department of Justice says a North Carolina school district was infected in 2017. Its network was disabled for about two weeks and losses passed $1.4 million.[5]

  3. July 20, 2018

    CISA publishes TA18-201A

    CISA and MS-ISAC issue the first technical alert on Emotet, with mitigation and remediation advice.[2]

  4. 30 September 2019

    CERT-EU advisory 2019-021

    CERT-EU reports new Emotet phishing campaigns seen since 16 September 2019 and gives detection and prevention advice.[7]

  5. February 2020

    COVID-19 themed phishing

    CISA and MS-ISAC say cybercriminals targeted countries outside the US with COVID-19 themed phishing emails to spread Emotet.[3]

  6. July 2020

    Emotet returns

    CISA and MS-ISAC say Emotet resurged in July 2020 after a dormant period that began in February.[3]

  7. 8 October 2020

    Canadian alert AL20-024

    The Canadian Centre for Cyber Security warns of renewed Emotet activity seen since July 2020, often alongside Trickbot and Ryuk.[6]

  8. 27 January 2021

    Global takedown

    Eurojust and Europol report that law enforcement in eight countries took control of Emotet's infrastructure and redirected infected machines to law-enforcement servers.[4]

  9. January 28, 2021

    US Justice Department announcement

    The Justice Department describes its part in the operation and says about 1.6 million infected computers were identified.[5]

Detection and defense

  1. Use the official detection resources

    CISA and MS-ISAC advisory AA20-280A carries Snort signatures for Emotet network activity. CERT-EU advisory 2019-021 gives a log query for PowerShell started by WMI and a proxy log pattern for command server traffic.[3, 7]

    Counters: T1047 T1059.001 T1071.001

  2. Filter email and block risky attachments

    Filter email at the gateway, block attachments often tied to malware such as .dll and .exe, block attachments antivirus cannot scan such as .zip, and mark external email with a banner.[2, 3]

    Counters: T1566.001 T1566.002

  3. Limit macros and PowerShell

    Avoid enabling macros in documents received by email. CERT-EU suggests banning Office macros where the business allows it and blocking PowerShell from downloading from the internet with local firewall rules.[6, 7]

    Counters: T1059.005 T1059.001 T1047

  4. Train staff

    Teach people to be careful with attachments and links, even when the sender looks known, and to report suspicious email to the security or IT team. Use DMARC to reduce spoofing.[2, 3, 6]

    Counters: T1204.001 T1204.002 T1566.002

  5. Slow the spread inside the network

    Restrict SMB traffic between client systems with a Group Policy firewall rule, segment networks, limit lateral communication, disable file and printer sharing that is not needed, and enforce multi-factor authentication.[2, 3]

    Counters: T1021.002 T1110.001 T1078.003

  6. Patch and limit privileges

    Run antivirus with automatic updates, apply patches after testing and give users only the access they need. CISA names an SMB exploit (MS17-010) among the ways Emotet spreads.[2, 3]

    Counters: T1210 T1003.001

  7. Keep tested backups

    The Canadian Cyber Centre advises daily backups of critical systems, with offline and offsite copies, and regular restore tests.[6]

  8. Respond to an infection

    Take infected machines off the network, do not log in to them with domain or shared local administrator accounts, reimage them, change domain, local and stored application passwords, and review Outlook mailbox rules for auto-forwarding.[2]

    Counters: T1078.003 T1087.003 T1114.001

Questions

What is Emotet?

A modular Windows malware that began as a banking Trojan in 2014 and became a loader that installs other malware. CISA describes it as a downloader or dropper of other banking Trojans.

Was Emotet shut down?

Its infrastructure was disrupted. Eurojust and Europol report that law enforcement took control of it in the week of 27 January 2021 and redirected infected machines to law-enforcement servers. The US Justice Department announced its part on 28 January 2021.

How does Emotet infect a computer?

Mainly through phishing emails with malicious attachments or links. Eurojust and Europol say the Word documents could prompt users to enable macros.

Is Emotet ransomware?

No. It is a loader. The US Justice Department says it can deliver other malware such as ransomware, and Eurojust and Europol say it was offered for hire to install ransomware and banking Trojans.

How can an organization protect itself?

CISA and MS-ISAC advise email filtering, blocking risky attachments, restricting SMB between workstations, multi-factor authentication, patching and least privilege. AA20-280A carries Snort signatures for detection.

In our research

  1. WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations January 2026
  2. Cyber Threats to the Qatar World Cup 2022 | Brandefense January 2023
  3. Vulnerability and Malware Trends of 2022 January 2023
  4. Bitdefender Releases Decryptor For MegaCortex January 2023
  5. Initial Access Methods: How Malicious Actors Do Infiltrate Companies? September 2022
  6. Wizard Spider Threat group

Sources

  1. Emotet, Software S0367 MITRE ATT&CKSupports: Names, 2014 start, techniques and the Wizard Spider link.
  2. Emotet Malware (TA18-201A) CISA and MS-ISACSupports: Modules, infection process, cost and mitigation advice.
  3. Emotet Malware (AA20-280A) CISA and MS-ISACSupports: 2020 resurgence, techniques, Snort signatures and mitigations.
  4. World's most dangerous malware EMOTET disrupted through global action Eurojust and EuropolSupports: January 2021 takedown, hire model, Word document lures.
  5. Emotet Botnet Disrupted in International Cyber Operation US Department of JusticeSupports: Takedown method, 1.6 million computers, 2017 school district case.
  6. Renewed Emotet Activity (AL20-024) Canadian Centre for Cyber SecuritySupports: October 2020 alert, Trickbot and Ryuk link, mitigations.
  7. Detecting and Preventing Emotet 2019 Campaign (2019-021) CERT-EUSupports: 2019 infection chain, detection and PowerShell prevention.

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Wizard Spider

Wizard Spider is a Russia-based criminal group behind the Trickbot malware, attributed by the US Department of Justice and Treasury, the UK government and Germany's BKA. Its work is stealing money and data and installing ransomware such as Ryuk and Conti. In 2023 the US charged nine members and the US and UK sanctioned 18 people.

Read more

Glossary term

Malware loader

A malware loader is a program whose main job is to get other malware onto a computer.

Read more