{
	"id": "8adceb0f-530b-4a58-a709-41afdb9d2f27",
	"created_at": "2026-04-06T00:16:21.203491Z",
	"updated_at": "2026-04-10T03:21:50.522101Z",
	"deleted_at": null,
	"sha1_hash": "82f5b14ecf701ab255a61a186acb6e1a16c9a590",
	"title": "March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 70919,
	"plain_text": "March 2023’s Most Wanted Malware: New Emotet Campaign\r\nBypasses Microsoft Blocks to Distribute Malicious OneNote Files\r\nBy gmcdouga\r\nPublished: 2023-04-10 · Archived: 2026-04-02 11:23:08 UTC\r\nCheck Point Research reports that Emotet Trojan launched a new campaign last\r\nmonth to evade Microsoft’s macro block, sending spam emails containing malicious\r\nOneNote files. Meanwhile Ahmyth was the most prevalent mobile malware and Log4j\r\ntook top spot once again as the most exploited vulnerability\r\nOur latest Global Threat Index for March 2023 saw researchers uncover a new malware campaign from Emotet\r\nTrojan, which rose to become the second most prevalent malware last month.\r\nAs reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files\r\nsince Microsoft announced they will block macros from office files. In the latest campaign, the attackers have\r\nadopted a new strategy of sending spam emails containing a malicious OneNote file. Once opened, a fake message\r\nappears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the\r\nmalware can gather user email data such as login credentials and contact information. The attackers then use the\r\ngathered information to expand the reach of the campaign and facilitate future attacks.\r\nWhile big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop\r\nevery attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it’s no\r\nsurprise to see it has managed to navigate Microsoft’s latest defenses. The most important thing people can do is\r\nmake sure they have appropriate email security in place, avoid downloading any unexpected files and adopt\r\nheathy skepticism about the origins of an email and its contents.\r\nLast month also revealed that “Apache Log4j Remote Code Execution” was the most exploited vulnerability,\r\nimpacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of\r\norganizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.\r\nTop Malware Families\r\n*The arrows relate to the change in rank compared to the previous month.\r\nQbot was the most prevalent malware last month with an impact of more than 10% on worldwide organizations\r\nrespectively, followed by Emotet and Formbook with a 4% global impact.\r\n1. ↔ Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a\r\nuser’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several\r\nanti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.\r\nhttps://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/\r\nPage 1 of 4\n\n2. ↑ Emotet – Emotet is an advanced, self-propagating and modular Trojan. Emotet used to be employed as a\r\nbanking Trojan but has recently been used as a distributor to other malware or malicious campaigns. It uses\r\nmultiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can\r\nbe spread through phishing spam emails containing malicious attachments or links.\r\n3. ↓ FormBook – FormBook is an Infostealer targeting Windows OS and was first detected in 2016. It is\r\nmarketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques\r\nand relatively low price. Formbook harvests credentials from various web browsers, collects screenshots,\r\nmonitors and logs keystrokes and can download and execute files according to orders from its C\u0026C.\r\n4. ↑ AgentTesla – AgentTesla is an advanced RAT functioning as a keylogger and information stealer, which\r\nis capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots,\r\nand exfiltrating credentials to a variety of software installed on a victim’s machine (including Google\r\nChrome, Mozilla Firefox and the Microsoft Outlook email client).\r\n5. ↓ XMRig – XMRig is open-source CPU mining software used to mine the Monero cryptocurrency. Threat\r\nactors often abuse this open-source software by integrating it into their malware to conduct illegal mining\r\non victims’ devices.\r\n6. ↔ GuLoader – Guloader is a downloader that has been widely used since December 2019. When it first\r\nappeared, GuLoader was used to download Parallax RAT but has been applied to other remote access\r\ntrojans and info-stealers such as Netwire, FormBook, and Agent Tesla.\r\n7. ↑ Remcos – Remcos is a RAT that first appeared in the wild in 2016. Remcos distributes itself through\r\nmalicious Microsoft Office documents, which are attached to SPAM emails, and is designed to bypass\r\nMicrosoft Windows’s UAC security and execute malware with high-level privileges.\r\n8. ↑ NJRat – NJRat is a remote accesses Trojan, targeting mainly government agencies and organizations in\r\nthe Middle East. The Trojan first emerged in 2012 and has multiple capabilities: capturing keystrokes,\r\naccessing the victim’s camera, stealing credentials stored in browsers, uploading and downloading files,\r\nperforming process and file manipulations, and viewing the victim’s desktop. NJRat infects victims via\r\nphishing attacks and drive-by downloads, and propagates through infected USB keys or networked drives,\r\nwith the support of Command \u0026 Control server software.\r\n9. ↔ Tofsee – Tofsee is a Trickler that targets the Windows platform. This malware attempts to download and\r\nexecute additional malicious files on target systems. It may download and display an image file to a user to\r\nhide its true purpose.\r\n10. ↓ NanoCore – NanoCore is a Remote Access Trojan that targets Windows operating system users and was\r\nfirst observed in the wild in 2013. All versions of the RAT contain basic plugins and functionalities such as\r\nscreen capture, crypto currency mining, remote control of the desktop and webcam session theft.\r\nTop Attacked Industries Globally\r\nLast month, Education/Research remained the most attacked industry globally, followed by\r\nGovernment/Military and then Healthcare.\r\n1. Education/Research\r\n2. Government/Military\r\n3. Healthcare\r\nTop Exploited Vulnerabilities\r\nhttps://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/\r\nPage 2 of 4\n\nLast month, “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of\r\norganizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations\r\nworldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.\r\n1. ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability\r\nexists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to\r\nexecute arbitrary code on the affected system.\r\n2. ↑ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-\r\n10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an\r\nHTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim\r\nmachine.\r\n3. ↑MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower\r\nDVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router\r\nvia a crafted request.\r\n4. ↑ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160,CVE-2014-0346) – An\r\ninformation disclosure vulnerability exists in OpenSSL. The vulnerability, aka Heartbleed, is due to an\r\nerror when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose\r\nmemory contents of a connected client or server.\r\n5. ↓ Web Servers Malicious URL Directory Traversal – There exists a directory traversal vulnerability on\r\ndifferent web servers. The vulnerability is due to an input validation error in a web server that does not\r\nproperly sanitize the URI for the directory traversal patterns. Successful exploitation allows\r\nunauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.\r\n6. ↑ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – An authentication bypass\r\nvulnerability exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow\r\nremote attackers to obtain sensitive information and gain unauthorized access into the affected system.\r\n7. ↔ PHP Easter Egg Information Disclosure – An information disclosure vulnerability has been reported\r\nin the PHP pages. The vulnerability is due to incorrect web server configuration. A remote attacker can\r\nexploit this vulnerability by sending a specially crafted URL to an affected PHP page.\r\n8. ↓ Command Injection Over HTTP (CVE-2021-43936,CVE-2022-24086) – A command Injection over\r\nHTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially\r\ncrafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on\r\nthe target machine.\r\n9. ↑ D-Link Multiple Products Remote Code Execution (CVE-2015-2051) – A remote code execution\r\nvulnerability exists in multiple D-Link products. Successful exploitation of this vulnerability could allow a\r\nremote attacker to execute arbitrary code on the affected system.\r\n10. ↓ WordPress portable-phpMyAdmin Plugin Authentication Bypass (CVE-2012-5469) – An\r\nauthentication bypass vulnerability exists in WordPress portable-phpMyAdmin Plugin. Successful\r\nexploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain\r\nunauthorized access into the affected system.\r\nTop Mobile Malwares\r\nhttps://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/\r\nPage 3 of 4\n\nLast month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and\r\nHiddad.\r\n1. AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android\r\napps that can be found on app stores and various websites. When a user installs one of these infected apps,\r\nthe malware can collect sensitive information from the device and perform actions such as keylogging,\r\ntaking screenshots, sending SMS messages, and activating the camera.\r\n2. Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially\r\ndetected, it has gained additional functions including Remote Access Trojan (RAT) functionality,\r\nkeylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds\r\nof different applications available in the Google Store.\r\n3. Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a\r\nthird-party store. Its main function is to display ads, but it can also gain access to key security details built\r\ninto the OS.\r\nCheck Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud\r\nintelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors\r\nworldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and\r\nexclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software\r\nTechnologies.\r\nSource: https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribu\r\nte-malicious-onenote-files/\r\nhttps://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/"
	],
	"report_names": [
		"march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files"
	],
	"threat_actors": [],
	"ts_created_at": 1775434581,
	"ts_updated_at": 1775791310,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/82f5b14ecf701ab255a61a186acb6e1a16c9a590.pdf",
		"text": "https://archive.orkl.eu/82f5b14ecf701ab255a61a186acb6e1a16c9a590.txt",
		"img": "https://archive.orkl.eu/82f5b14ecf701ab255a61a186acb6e1a16c9a590.jpg"
	}
}