Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is a Trojan? How Trojan malware works

In one sentence: A Trojan is malicious software that pretends to be something harmless, such as an invoice or a document, so you let it in yourself.

What it is

A Trojan is named after the wooden horse. It looks like a legitimate file, such as a PDF receipt, a Word document or a software update, but it carries hidden malicious code. Unlike a worm, it normally needs a person to open it.

Many Trojans are loaders. CISA describes Emotet as an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. In practice the first infection is often just a door opener, and the damage, such as ransomware, comes later.

How it works

Using the pattern CISA described for Emotet:

  1. The Trojan arrives in an email carrying a malicious link, PDF or macro-enabled Word document, often branded to look familiar, such as a PayPal receipt, shipping notice or overdue invoice.
  2. The user opens it. CISA says the initial infection occurs when a user opens or clicks the malicious download link, PDF or macro-enabled document.
  3. The Trojan establishes persistence, using registry keys or scheduled tasks, and contacts a command and control server.
  4. It downloads more malware and steals information. CISA notes spreader modules that recover saved passwords and an Outlook scraper that uses the victim’s contacts to send more phishing emails.
  5. It spreads across the network. CISA says Emotet’s access to SMB can result in infection of entire domains.

Who it affects and how badly

Any organisation that opens email attachments, so all of them. Sole traders risk stolen passwords and bank logins. Accountancy, legal and recruitment firms, which receive documents from strangers every day, are natural targets. Schools, charities and councils with older systems and shared devices are exposed to the spreading behaviour. Manufacturers and care providers face downtime if a Trojan hands over to ransomware.

CISA reported in 2018 that Emotet infections had cost state, local, tribal and territorial governments up to $1 million per incident to remediate. For regulated firms the added costs are breach reporting and fines if personal data was taken.

Real examples

Emotet, 2018 CISA alert. CISA and MS-ISAC described Emotet as among the most costly and destructive malware affecting government and the private and public sectors, spread by malspam and with worm-like features that make it difficult to combat. Source: https://www.cisa.gov/news-events/alerts/2018/07/20/emotet-malware

How to detect it

  • Watch for unexpected macro prompts and Office files that launch scripts.
  • Look in Microsoft Defender or your endpoint tool for alerts about scripts launched from Office, new scheduled tasks and new registry run keys. CISA says Emotet persistence is typically through scheduled tasks or registry keys.
  • Look for repeated outbound connections to unfamiliar domains.
  • Check for password-recovery tools or unusual SMB traffic between workstations.
  • Check whether customers receive emails you did not send, a sign of an Outlook scraper.

How to fix or prevent it

  1. Filter email. The NCSC advises mail filtering that can block malicious emails and remove executable attachments.
  2. Block Office macros from the internet through Group Policy or Intune, and stop users enabling them.
  3. Keep endpoint protection and patching current, and remove local admin rights.
  4. Stop workstations talking to each other over SMB unless needed. Segmenting the network limits spread.
  5. Keep recent offline backups. The NCSC says to plan for an attack even if you think it unlikely.
  6. Use MFA and unique passwords so stolen saved passwords are less useful.
  7. Train staff to report odd attachments.

Related terms

Browse the full Resources library.

FAQ

Is a Trojan a virus? Not quite. A Trojan disguises itself and usually needs you to open it, while a virus or worm spreads itself.

What does a Trojan do? CISA describes Emotet as a downloader or dropper of other malware that also steals data and spreads.

How do Trojans arrive? In the Emotet example, through emails with malicious links, PDFs or macro-enabled documents.

How Wolfcore helps

Wolfcore’s ransomware readiness assessment shows how far an attacker would get and what you would lose, and our SOC monitoring keeps watch after the test. See Wolfcore pricing.