The Malware-as-a-Service Emotet

This ANSSI report analyzes Emotet’s origins and evolution from a banking trojan into a sophisticated malware‑as‑a‑service run by TA542, detailing its phishing-based infection vectors (malicious macros, thread‑hijacking, smishing and watering‑hole), modular architecture and C2 behavior, its use to distribute a wide range of secondary payloads including banking trojans and ransomware (e.g., TrickBot, QakBot, Ryuk/Conti), observed links with other criminal groups and recommendations for detection and monitoring (notably public IOC feeds).