Breach Disclosure: Emotet

Breach Disclosure: Emotet The FBI and the Dutch NHTCU have released over 4 million email addresses of accounts victimized by the Emotet trojan. According to HIBP, 39% of the victim accounts were already known from previous breaches.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details On 25 April, the FBI, in coordination with the Dutch National High Technical Crimes Unit (NHTCU) released 4,324,770 emails to the Have I Been Pwned (HIBP) data breach notification website. Due to the sensitive nature of the data, HIBP is not listing the accounts in a searchable format, but the site is sending out direct victim notifications. Alternately, if an administrator can provide proof of ownership of a domain they will be able to see if they are impacted via the HIBP notification service or by a domain search.
These accounts were released following a seizure of the botnet’s infrastructure by international law enforcement in eight countries on January 27th, and a measure remotely directing all copies of the malware to uninstall themselves from victim computers, also on April 25.