# Emotet Botnet Global Victimology and Malspam-Delivered Qakbot Payloads

> Kryptos Logic Vantage telemetry from actively infected Emotet peers identified 70,000+ unique IPs, 4,000+ ASNs and 5,000+ organizations across 170 countries. The same report analyzes Qakbot (QBot) samples distributed as Emotet malspam payloads, using protocol version 15 with 31 C&C commands and banking web injects.

- **Published:** 2026-10-17T18:31:25Z
- **Last reviewed:** 2026-10-17T18:31:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3830
- **ID:** TL-2026-3830
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In August 2018 Kryptos Logic published telemetry-based victimology for the Emotet botnet, collected from Vantage sensors that observed actively infected Emotet peers. The data showed 70,000+ unique IP addresses, 4,000+ unique ASNs and 5,000+ organizations and telecoms in 170 countries. The United States and South Korea led by hit volume, and the United States, India and China led by unique IPs. Kryptos Logic estimated 50,000-150,000 infected nodes at any given time. US-CERT (TA18-201A) reports that Emotet incidents have cost State, Local, Tribal and Territorial (SLTT) governments up to $1 million per incident to remediate.

Emotet is delivered by malspam. The lures include malicious download links, PDFs and macro-enabled Microsoft Word documents, and CISA documents lures imitating PayPal receipts and shipping notifications and abusing the MS-ISAC name. Once running, Emotet persists through auto-start registry keys and randomly named Windows services, and injects code into explorer.exe and other running processes. It reports the new infection to its C2, receives configuration data, downloads and runs further files, and uploads collected data. CISA lists five spreader modules: NetPass.exe, an Outlook scraper, WebBrowserPassView, Mail PassView, and a credential enumerator that scans network shares over SMB or brute-forces administrator accounts.

The Kryptos Logic report also analyzes recent Qakbot (QBot) samples dropped through Emotet malspam, version 322.368. These samples use protocol version 15, up from earlier versions in the 10-12 range. They support 31 C&C commands, up from 25. The DGA appears to be gone, and the 1024-bit RSA key was removed in favor of the 2048-bit key only. Qakbot disables HTTP2 in Firefox by modifying profile.js and hooks nspr4!PR.Read to intercept browser traffic. It includes a UPnP library and a decentralized proxy-peer C2 architecture, and carries banking web injects. The samples use PowerShell and defense-evasion techniques, and some are signed with stolen code-signing certificates. Because C2 is IP-based and relayed through infected peers, blacklisting is harder than with domain-based infrastructure.

The article lists no CVEs, IPs or domains. Its IOCs are in three linked files (malicious binaries, webinject URLs, webinject paths) that were not retrievable or verified in this research. Later reporting shows the Emotet-to-Qakbot relationship continuing: in July 2020 Emotet switched its payload from TrickBot to QakBot (campaign ID 'partner01'), and BleepingComputer noted that some victims may then receive ransomware such as ProLock.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1055 Process Injection
- T1553.002 Code Signing
- T1555.003 Credentials from Web Browsers
- T1110.001 Password Guessing
- T1056.004 Credential API Hooking
- T1114.001 Local Email Collection
- T1185 Browser Session Hijacking
- T1021.002 SMB/Windows Admin Shares
- T1090 Proxy
- T1573.002 Asymmetric Cryptography

## Sources

- [Inside Look at Emotet's Global Victims and Malspam Qakbot Payloads](https://www.kryptoslogic.com/blog/2018/08/inside-look-at-emotets-global-victims-and-malspam-qakbot-payloads/)
- [CISA Alert TA18-201A: Emotet Malware](https://www.cisa.gov/news-events/alerts/2018/07/20/emotet-malware)
- [Emotet Botnet is now Heavily Spreading QakBot Malware](https://www.bleepingcomputer.com/news/security/emotet-botnet-is-now-heavily-spreading-qakbot-malware/)
- [Recent Emotet activity (SANS ISC Diary 23908)](https://isc.sans.edu/diary/23908)
- [2018-12-14 - Emotet Infection with Qakbot](https://malware-traffic-analysis.net/2018/12/14/index.html)
- [Update: Emotet Botnet Delivering QBot Banking Trojan](https://www.govinfosecurity.com/update-emotet-botnet-delivering-qbot-banking-trojan-a-14684)
- [HHS Emotet Update](https://www.hhs.gov/sites/default/files/emotet-update.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3830