Ankura CTIX FLASH Update - March 28, 2023

Malware Activity

New Phishing Campaign Impersonating IRS to Distribute the "Emotet" Malware

Researchers have identified a new phishing campaign impersonating the Internal Revenue Service (IRS) to send fraudulent W-9 tax forms that contain the "Emotet" malware. Emotet is known to be historically distributed through malicious Microsoft Word and Excel documents in a variety of themed phishing campaigns, typically coinciding with holidays or business activities done at specific times of the year. However, the malware operators have recently begun to change their distribution method to Microsoft OneNote containing embedded scripts following the blocking of macros by default in Office documents. In this latest campaign, the malware operators are using an "IRS Tax Forms W-9" theme and specified that the sender of the phishing emails was an "inspector" from the IRS. Attached to the emails is a ZIP archive titled "W-9 form.zip" that contains a malicious Word document