Loading story…
The Emotet malware operation changed its infection tactics as Microsoft tightened default protections around Office macros, a long-used initial access method for malware delivered through phishing documents. Reporting indicates the group adapted its delivery chain to preserve access to victims despite the reduced effectiveness of malicious macro-enabled attachments.
The shift highlights how defensive changes by major software vendors can force established threat actors to retool rather than disappear. For defenders, the development underscores the need to monitor for alternative attachment and execution methods linked to Emotet campaigns, review email security controls, and harden endpoints against follow-on payload delivery after initial compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By January 2023, security reporting showed threat actors were increasingly using Microsoft OneNote attachments as a malware delivery method. This reflected a broader adaptation in initial access techniques following Microsoft's tightening of Office macro security.
On July 21, 2022, Microsoft announced that VBA macros would be blocked by default in Office documents downloaded from the internet, changing how users could enable macro content. The move significantly disrupted phishing campaigns that relied on malicious macro-enabled Office attachments.
A McAfee Labs report highlighted the rise of Windows LNK shortcut files as a malware delivery mechanism, reflecting attackers' shift away from traditional macro-enabled Office documents. This marked another tactical adaptation as defenders and platform vendors tightened macro-based infection paths.
By the time of ESET's June 16, 2022 report, Microsoft was tightening default Office macro security controls, and Emotet operators were adapting their delivery techniques in response. The report frames this policy shift and the malware group's resulting tactical changes as the key development.
Kroll observed that on April 22, 2022, Emotet operators changed the Epoch4 botnet subgroup’s loader delivery mechanism from malicious Office documents to password-protected ZIP archives containing malicious LNK shortcut files. The report says this was the first time Emotet had been seen using LNK files to package malicious PowerShell or VBScript in its infection chain.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcefourcore.io
Open sourcemcafee.com
Open sourcewelivesecurity.com
Open sourcekroll.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Emotet continued to evolve from a banking trojan into a resilient modular malware platform, using phishing and thread-hijacked emails to deliver malicious Office files, password-protected ZIP archives, oversized documents, OneNote attachments, and later `.LNK` shortcut files. Multiple analyses showed operators repeatedly changing initial access and execution methods: older campaigns relied on VBA or XLM macros, while later waves used embedded VBScript, JavaScript, and shortcut-based loaders to fetch DLL payloads from hard-coded URLs and execute them with LOLBins such as `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `cmd.exe`, `PowerShell`, and `certutil.exe`. Researchers also documented a shift from earlier "Project X" payloads to a newer "Project Y" core DLL, alongside continued use of thread hijacking and downloader chains designed to blend into normal Windows activity. Technical reporting showed Emotet actively bypassing common defenses and maintaining a mature post-infection capability set. One Word-document sample used WMI so that `cmd.exe` was spawned by `WmiPrvSe.exe` instead of directly by Word, sidestepping Microsoft Defender's Office child-process Attack Surface Reduction rule; another macro deobfuscated strings, launched WMI-backed process creation, and ran a base64-encoded PowerShell downloader. Across samples, the malware established persistence through Registry Run keys or Windows services depending on privilege level, used process hollowing, browser credential theft modules, encrypted command-and-control with embedded RSA/AES or ECC-based protections, and rotated hard-coded C2 infrastructure. Defenders were advised to block password-protected archives and macro-enabled documents where possible, hunt for WMI-originated process creation, and monitor for suspicious use of `regsvr32.exe`, `rundll32.exe`, and other LOLBins tied to Emotet delivery chains.
Aug 15, 2026
Emotet operators resumed large-scale phishing activity by sending emails from compromised organizational mail servers and using spoofed display names, reply-style subject lines, and topical lures such as IRS tax notices. Multiple reports found the messages commonly carried password-protected ZIP archives containing malicious Excel files with legacy **Excel 4.0/XLM macros**. After a user enabled editing or macros, the spreadsheet downloaded an Emotet payload from compromised or attacker-controlled URLs and launched it with **`regsvr32.exe`**, restoring Emotet’s foothold after its earlier disruption. Researchers observed that infected hosts then contacted multiple Emotet command-and-control servers and could be repurposed as spambots to send additional phishing emails with malicious spreadsheet attachments, extending the campaign. Analysis across the reports identified packed DLL or OCX payloads, Windows service persistence, and follow-on risk including delivery of tools such as **Cobalt Strike** or **SystemBC**. The references also published hunting and detection material, including Microsoft 365 Defender KQL queries, file hashes, domains, IP addresses, and JA3/JA3S TLS fingerprints, while noting that the campaigns continued to succeed partly because some environments still allowed Office macros despite Microsoft hardening changes.
Aug 15, 2026
Emotet remained a major malware delivery platform even after international authorities disrupted its botnet infrastructure, with investigators linking it to infections on roughly **1.6 million systems** and to follow-on malware including **TrickBot**, **IcedID**, **AZORult**, and ransomware. Security research described a resilient, modular architecture in which a loader decrypted in-memory DLL modules for spamming, credential theft, Outlook harvesting, and proxying, while operators maintained parallel command-and-control infrastructures and rotated keys to complicate tracking. Campaigns commonly began with phishing emails, hijacked threads, or themed lures such as COVID-19 notices, invoices, jobs, and shipping messages, then used obfuscated Office documents, PowerShell, and `rundll32.exe` to install persistence, move payloads into randomized paths, and exfiltrate data over encrypted web traffic. After the 2021 law-enforcement action, Emotet re-emerged with updated tooling and repeatedly changed its initial access methods to preserve infection rates. Researchers observed new loaders that decrypted embedded payloads directly, stronger obfuscation, possible movement from HTTP to **HTTPS** using cryptographic libraries, and continued runtime unpacking that hindered static detection. The operators also adapted to Microsoft’s macro restrictions by testing **XLL** files, then shifting from Word attachments to **OneNote**, **WSF**, **VBScript**, and later **JavaScript** downloaders delivered through ZIP archives or cloud-storage links. Additional telemetry showed ongoing changes in bot behavior, including altered spambot SMTP formatting, underscoring that Emotet’s operators continued to refine both malware internals and large-scale email distribution tactics.
Aug 15, 2026