Summary

Threat actors often try to bandwagon on current events to trick their victims into falling for their lures. To this end, Emotet also this year sending fake Halloween party invitations to potential victims. While the basic concept behind the fake Halloween party invitations this year is the same as last year, the variety in email texts has increased.

Analysis

At around 2020-10-29 12:30 UTC Hornetsecurity’s email filters registered the first Emotet malspam emails containing Halloween party invitation themed lures. The event lasted for around 3 hours and accounted for around 50 % of Emotet malspam, as can be seen from the following time histogram stacking Emotet malspam emails by subject:

Emotet 2020 Halloween invitation malspam

Unlike the Emotet Halloween party invitations of 2019, which varied only in the subject lines and attachment names, this years emails provide different email body text templates as well.

Emotet 2020 Halloween invitation malspam email example

Emotet 2020 Halloween invitation malspam email example

Emotet 2020 Halloween invitation malspam email example

Emotet 2020 Halloween invitation malspam email example

Emotet 2020 Halloween invitation malspam email example

Emotet 2020 Halloween invitation malspam email example

In 2019 only the following email text could be observed:

Emotet 2019 halloween email lure

Emotet 2019 halloween email lure

The Emotet malware itself has not changed. Hornetsecurity already reported on Emotet extensively.1,2,3,4

Conclusion and Countermeasure

It seems that Emotet’s fake Halloween party invitations are now a yearly thing that email uses need to watch out for.

Emotet’s malicious attachments are caught by Hornetsecurity’s Spam and Malware Protection. Hence, Hornetsecurity customer’s Halloween is not ruined by falling for Emotet’s fake Halloween party invitations.

References

Indicators of Compromise (IOCs)

Email subject lines

  • Inviting friends to your Halloween Extravaganza
  • Party tonight
  • Happy Halloween
  • Halloween party
  • Halloween Pot Luck 10.31
  • Party invitation
  • Halloween invitation
  • Halloween
  • Halloween party invitation
  • Halloween Party