Construction Engineers Center: an office PC was infected with Emotet, leaking addresses and mail text of applicants and other contacts

1. 2020-09-17

   In the morning, a Word file attached to a received mail was opened on an office PC and infected it. From around noon, suspicious mail quoting old messages and using the names of staff, applicants for engineer certificates and partner companies went out from unrelated servers. In the afternoon, all office PCs were cut off from the internet, and EmoCheck identified the two infected machines. [1]

2. 2020-09-18

   The center published what happened and asked people to delete mail in staff names that did not come from its own domain. [1]

The names and addresses of people the PC had exchanged mail with, and the message text, leaked. The certificate system and other services ran on a separate network, and the center said work other than mail and data on its servers were not affected. [1]

Its mail filter had been removing Word-type Emotet, but this time the malware arrived in forms such as password-protected zip files and may have slipped through. [1]