Thread by @Cryptolaemus1

🚨🚨WARNING 🚨🚨 We have confirmed that #Emotet is dropping CS Beacons on E5 Bots and we have observed the following as of 10:00EST/15:00UTC. The following beacon was dropped: tria.ge/211207-t5l24sb… Note the traffic to lartmana[.]com. This is an active CS Teams Server. 1/x

Also note the strange fingerprint of 0. The full config observed here H/T: @TheHack3r4chan pastebin.com/raw/KtUC5CGL What does this mean? This means the game has changed and Ivan has shortened the pipeline to exfil/Ransomware substantially. 2/x

No Trickbot or other intermediate garbage. Straight to CS and lateral movement to DCs/Critical Parts of the network. You need to pay attention to this and you need to prepare. It has started, block this C2 now! 3/x

Getting #Emotet on your network is no longer just an irritation or commodity malware noise. This should be very high on your threat model now. Be safe out there and don't let Ivan ruin your holidays. Stay vigilant! 4/x

Thanks to @Max_Mal_ for cluing us into this to start and informing us of active IR cases. We appreciate the community sharing and try to look into all things Emotet so H/T to @Max_Mal_ ❤️