Executive Summary
- November 2021 marked the return of Emotet after the botnet was taken down by law enforcement in January 2021.
Summary
In this installment of our monthly email threat review, we present an overview of the email-based threats observed in November 2021 and compare them to the previous month’s threats.
The report provides insights into:
- Unwanted emails by category
- File types used in attacks
- Industry Email Threat Index
- Attack techniques
- Impersonated company brands and organizations
- Return of Emotet
Unwanted emails by category
The following table shows the distribution of unwanted emails per category.
| Email category | % |
|---|---|
| Rejected | 81.00 |
| Spam | 13.42 |
| Threat | 4.67 |
| AdvThreat | 0.88 |
| Content | 0.03 |
The following time histogram shows the email volume per category per day.
Methodology
The listed email categories correspond to the email categories listed in the Email Live Tracking of Hornetsecurity’s Control Panel. So our users are already familiar with them. For others, the categories are:
| Category | Description |
|---|---|
| Spam | These emails are unwanted and are often promotional or fraudulent. The emails are sent simultaneously to a large number of recipients. |
| Content | These emails have an invalid attachment. The administrators define in the Content Control module which attachments are invalid. |
| Threat | These emails contain harmful content, such as malicious attachments or links, or they are sent to commit crimes, such as phishing. |
| AdvThreat | Advanced Threat Protection has detected a threat in these emails. The emails are used for illegal purposes and involve sophisticated technical means that can only be fended off using advanced dynamic procedures. |
| Rejected | Our email server rejects these emails directly during the SMTP dialog because of external characteristics, such as the sender’s identity, and the emails are not analyzed further. |
File types used in attacks
The following table shows the distribution of file types used in attacks.
| File type (used in malicious emails) | % |
|---|---|
| Archive | 28.9 |
| HTML | 23.1 |
| 18.1 | |
| Excel | 12.0 |
| Disk image files | 4.9 |
| Other | 4.8 |
| Word | 3.9 |
| Executable | 3.5 |
| 0.6 | |
| Script file | 0.1 |
| Powerpoint | 0.1 |
| LNK file | 0.0 |
The following histogram shows the email volume per file type used in attacks per 7 days.
Industry Email Threat Index
The following table shows our Industry Email Threat Index calculated based on the number of threat emails compared to each industry’s clean emails received (in median).
| Industries | Share of threat in threat and clean emails |
|---|---|
| Research industry | 6.0 |
| Manufacturing industry | 5.2 |
| Media industry | 4.6 |
| Healthcare industry | 4.6 |
| Automotive industry | 4.3 |
| Education industry | 4.2 |
| Utilities | 3.9 |
| Mining industry | 3.8 |
| Construction industry | 3.5 |
| Transport industry | 3.5 |
| Financial industry | 3.4 |
The following bar chart visualizes the email-based threat posed to each industry.
Methodology
Different (sized) organizations receive a different absolute number of emails. Thus, we calculate the percent share of threat emails from each organization’s threat and clean emails to compare organizations. We then calculate the median of these percent values for all organizations within the same industry to form the industry’s final threat score.
Attack techniques
The following table shows the attack techniques used in attacks.
| Attack technique | % |
|---|---|
| Phishing | 49.6 |
| Other | 31.9 |
| URL | 6.8 |
| Extortion | 3.9 |
| Executable in archive/disk-image | 2.4 |
| Impersonation | 2.3 |
| Advance-fee scam | 2.2 |
| Maldoc | 0.8 |
| LNK | 0.0 |
The following histogram shows the email volume per attack technique used per hour.
Impersonated company brands and organizations
The following table shows which company brands and organizations our systems detected most in impersonation attacks.
| Impersonated brand or organization | % |
|---|---|
| Sparkasse | 62.2 |
| Volks- und Raiffeisenbank | 11.7 |
| Amazon | 4.9 |
| Deutsche Post / DHL | 4.0 |
| PayPal | 2.1 |
| DocuSign | 1.7 |
| UPS | 1.4 |
| 1.3 | |
| Fedex | 1.2 |
The following histogram shows the email volume for company brands and organizations detected in impersonation attacks per hour.
It clearly shows the continued campaigns against German banks Sparkasse and Volks- und Raiffeisenbank that started at the end of September 2021.
Return of Emotet
On 2021-11-15, computer systems infected with the TrickBot malware started downloading and installing the Emotet malware. Subsequently, the Emotet botnet was rebuilt and sent malspam from its botnet again. We reported this event in a separate blogpost.
