Hello, welcome to the Wednesday, November 17, 2021 edition of the Santernate Storm Center's

Stormcast. My name is Johannes Ulrich, and I'm recording from Fort Walton Beach, Florida.

Back in January, Ukrainian law enforcement and others took down the principles behind the Emotet botnet. And since then,

there hasn't really been much to be said about Emotet. It was pretty much dead, but sadly,

not dead for good. As of this week, we start having new EMUD samples arriving in victims' in boxes.

And I guess to celebrate, Brad did publish a diary today with one of his famous walkthroughs of

an EMOTT infection and what kind of traffic this botnet is generating.

One of the reasons that Emot Head is so dangerous is the emails that it crafts are crafted as replies to actual emails.

So as soon as a victim is compromised, it pilferes recent emails in the victim's inbox and replies to these emails, including its

malicious attachment. The attachment itself, well, nothing really all too special. It's a Microsoft

office document with a macro and of course a message asking the user to enable macros so it can do its evil thing.

One thing Brad pointed out that changed is that additional downloads and the command control

mechanism now uses HTTP. Prior versions have done this via HTTP.

So office macros still remain sort of one of the major issues here that you

need to get a handle on. And of course, that's not just because of Emotet. There are plenty of

other pieces of malware that take advantage of essentially the same trick, trying to get users

to enable macros in order to then download and run additional malware.

And as far as EmoThead goes, I don't think the use of HDPS is adding sort of a new significant barrier to detection.

And GitHub, who is maintaining the NPM registry, has published a brief blog post outlining

two vulnerabilities that were recently addressed in the NPM registry and some of the security

enhancements planned for the near future. First of all, the vulnerabilities, The first one potentially did expose the presence and the names of internal NPM packages.

This, of course, could be dangerous with respect to some name confusion issues that we talked

...