Threat reportMalwareTL-2026-3830
Emotet Botnet Global Victimology and Malspam-Delivered Qakbot Payloads
Emotet Botnet Global Victimology and Malspam-Delivered (TL-2026-3830), also tracked as Emotet, is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1021.002, T1055, T1056.004), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3830
- Threat ID
- TL-2026-3830
- Also known as
- Emotet, Geodo, Qakbot, QBot
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, telecoms, finance, enterprise
- Target regions
- North America, Asia, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Emotet Botnet Global Victimology and Malspam-Delivered
Malware and tooling: Emotet - S0367, QakBot, Mail PassView, WebBrowserPassView
How Emotet Botnet Global Victimology and Malspam-Delivered works
Kryptos Logic Vantage telemetry from actively infected Emotet peers identified 70,000+ unique IPs, 4,000+ ASNs and 5,000+ organizations across 170 countries. The same report analyzes Qakbot (QBot) samples distributed as Emotet malspam payloads, using protocol version 15 with 31 C&C commands and banking web injects.
In August 2018 Kryptos Logic published telemetry-based victimology for the Emotet botnet, collected from Vantage sensors that observed actively infected Emotet peers. The data showed 70,000+ unique IP addresses, 4,000+ unique ASNs and 5,000+ organizations and telecoms in 170 countries. The United States and South Korea led by hit volume, and the United States, India and China led by unique IPs. Kryptos Logic estimated 50,000-150,000 infected nodes at any given time. US-CERT (TA18-201A) reports that Emotet incidents have cost State, Local, Tribal and Territorial (SLTT) governments up to $1 million per incident to remediate.
Emotet is delivered by malspam. The lures include malicious download links, PDFs and macro-enabled Microsoft Word documents, and CISA documents lures imitating PayPal receipts and shipping notifications and abusing the MS-ISAC name. Once running, Emotet persists through auto-start registry keys and randomly named Windows services, and injects code into explorer.exe and other running processes. It reports the new infection to its C2, receives configuration data, downloads and runs further files, and uploads collected data. CISA lists five spreader modules: NetPass.exe, an Outlook scraper, WebBrowserPassView, Mail PassView, and a credential enumerator that scans network shares over SMB or brute-forces administrator accounts.
The Kryptos Logic report also analyzes recent Qakbot (QBot) samples dropped through Emotet malspam, version 322.368. These samples use protocol version 15, up from earlier versions in the 10-12 range. They support 31 C&C commands, up from 25. The DGA appears to be gone, and the 1024-bit RSA key was removed in favor of the 2048-bit key only. Qakbot disables HTTP2 in Firefox by modifying profile.js and hooks nspr4!PR.Read to intercept browser traffic. It includes a UPnP library and a decentralized proxy-peer C2 architecture, and carries banking web injects. The samples use PowerShell and defense-evasion techniques, and some are signed with stolen code-signing certificates. Because C2 is IP-based and relayed through infected peers, blacklisting is harder than with domain-based infrastructure.
The article lists no CVEs, IPs or domains. Its IOCs are in three linked files (malicious binaries, webinject URLs, webinject paths) that were not retrievable or verified in this research. Later reporting shows the Emotet-to-Qakbot relationship continuing: in July 2020 Emotet switched its payload from TrickBot to QakBot (campaign ID 'partner01'), and BleepingComputer noted that some victims may then receive ransomware such as ProLock.
MITRE ATT&CK techniques used in TL-2026-3830
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
Credential Access
T1056.004 Credential API Hooking; T1110.001 Password Guessing; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1573.002 Asymmetric Cryptography
Collection
T1114.001 Local Email Collection; T1185 Browser Session Hijacking
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in Emotet Botnet Global Victimology and Malspam-Delivered
Remediation for Emotet Botnet Global Victimology and Malspam-Delivered
Patches
- Keep operating systems, browsers and Office up to date as recommended in CISA TA18-201A
Immediate actions
- Block inbound malspam carrying macro-enabled Office documents, PDFs and download links at the mail gateway
- Hunt for explorer.exe injection, randomly named services and shedaudio.exe in the user AppData profile
- Reset credentials on hosts where NetPass.exe, WebBrowserPassView or Mail PassView artifacts are found
- Isolate infected hosts, since Emotet spreads over SMB and brute-forces administrator accounts
Workarounds
- Block IP-based C2 communications seen in Emotet and Qakbot telemetry at the perimeter
- Use application allowlisting to block unsigned or untrusted binaries in user-writable paths
Longer-term hardening
- Disable Office macros from the internet and enforce Protected View
- Segment networks and restrict SMB between workstations
- Enforce strong unique administrator passwords and MFA
- Deploy EDR with process-injection and browser API hooking detection
- Monitor for Firefox profile.js modification
Timeline of Emotet Botnet Global Victimology and Malspam-Delivered
- US-CERT publishes Alert TA18-201A on Emotet, describing malspam delivery, spreader modules and costs of up to $1 million per incident for SLTT governments.
- Qakbot DGA appears completely removed, the 1024-bit RSA key is dropped in favor of 2048-bit, and Firefox HTTP2 is disabled via profile.js.
- Kryptos Logic analyzes Qakbot version 322.368 delivered as an Emotet malspam payload: protocol version 15 (up from 10-12), 31 C&C commands (up from 25), banking web injects.
- Kryptos Logic publishes Vantage telemetry on Emotet victimology: 70,000+ unique IPs, 4,000+ ASNs, 5,000+ organizations, 170 countries, with an estimated 50,000-150,000 infected nodes at a time.
- Malware-traffic-analysis.net documents an Emotet infection chain leading to Qakbot.
- After returning from a 5+ month hiatus, Emotet shifts payload distribution to QakBot across all epochs (campaign ID 'partner01'). BleepingComputer notes some victims may receive ProLock ransomware.
Sources cited for Emotet Botnet Global Victimology and Malspam-Delivered
- Inside Look at Emotet's Global Victims and Malspam Qakbot Payloads
- CISA Alert TA18-201A: Emotet Malware
- Emotet Botnet is now Heavily Spreading QakBot Malware
- Recent Emotet activity (SANS ISC Diary 23908)
- 2018-12-14 - Emotet Infection with Qakbot
- Update: Emotet Botnet Delivering QBot Banking Trojan
- HHS Emotet Update
Detection coverage for TL-2026-3830
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3830 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.