Frankfurt, home of the European Central Bank, has been forced to shut down its IT network following an Emotet malware infection.

This attack makes Frankfurt the fourth entity to be hit by Emotet in the past two weeks. Justus Liebig University (JLU) in Gießen, a town north of Frankfurt; Bad Homburg, another city north of Frankfurt; and the Catholic University in Freiburg, a city in southwest Germany have also been hit by the malware.

First discovered in 2014, Emotet is a banking Trojan that has worm-like capabilities to help it infect other systems and is primarily spread via malspam. It generates money by renting access to infected hosts to other malware groups, including ransomware operators.

Although shutting down an IT network incurs major financial losses, it is a necessary step in this case to prevent Emotet being used as a staging point to launch a ransomware attack.

The malware was not caught early enough in the JLU attack, and according to German newspaper Hessenschau, citing the General Prosecutor Office in Frankfurt, it was used to deploy Ryuk ransomware on the university’s network.

The university is still dealing with the aftermath, which saw 38,000 students and staff forced to queue in huge lines to get a new password for their academic accounts issued.

Recommended 

• Wakanda Listed as Trading Partner by US Department of Agriculture
• Top EU Court Rules Airbnb is Not a Real Estate Agency
• How to Protect Your Business from Phishing and Whaling Scams

The next day the Catholic University in Freiburg became the second victim of Emotet, and the following day Frankfurt and Bad Homburg reported infections.

It appears Frankfurt has been hit the worst by the attack with all the city’s IT-related services down, from its website to its pubic transportation ticketing services.

BSI, Germany’s cyber-security agency, issued a warning on the same day of the attack warning organisations about an Emotet email spam campaign that was mimicking German government agencies.