Loading story…
Emotet repeatedly resurfaced as one of the most disruptive malware botnets, using stolen email content, thread hijacking, and large-scale spam operations to infect victims and deliver additional payloads. Reporting across multiple years described the malware harvesting millions of emails, sending highly convincing lures that referenced real names and prior conversations, and acting as a downloader trojan that opened the door to follow-on malware. CISA and DHS warned that Emotet had become one of the most prevalent threats, while defenders including Microsoft highlighted the scale of enterprise outbreaks and the need for rapid detection and containment.
The botnet proved resilient even after major disruption efforts. After law enforcement dismantled infrastructure and carried out a mass uninstall operation, Emotet operators reestablished activity and later returned with updated tactics, according to reporting from The Record, ZDNET, and Ars Technica. Incidents affecting organizations such as Heise underscored the operational impact of infections, while later campaigns showed the malware adapting its social-engineering methods and delivery techniques to regain footholds in corporate environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Ars Technica reported that Emotet was back in 2023 using updated lures, including personalized messages that referenced recipients' names and quoted prior emails.
The Record reported that Emotet resumed operations months after the international takedown and uninstall action, showing that the botnet operators had rebuilt activity.
International law enforcement dismantled Emotet infrastructure and deployed a mass-uninstall operation to remove the malware from infected systems, temporarily disrupting the botnet.
Ars Technica reported on a DHS warning that Emotet was one of the most prevalent malware threats at the time, underscoring its widespread impact in 2020.
Heise reported that it had been affected by Emotet, representing a disclosed victim-side incident tied to the malware's 2019 activity.
ZDNet reported that Emotet had come back to life in 2019, marking another major resurgence of the botnet after prior disruption and quieter periods.
US-CERT/CISA published alert TA18-201A on Emotet, formally warning that the malware was a significant threat and providing technical and mitigation guidance.
Microsoft disclosed that its security systems detected and stopped an Emotet outbreak, highlighting the malware's continued spread and the need for automated defenses.
McAfee reported a renewed Emotet surge, describing the malware's return as an active downloader trojan campaign affecting organizations again in late 2017.
ZDNet reported that the Emotet malware gang was running a large-scale campaign to harvest millions of email addresses, indicating the botnet's growing operational reach and spam capabilities.
9 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcetherecord.media
Open sourcearstechnica.com
Open sourceheise.de
Open sourcezdnet.com
Open sourcecisa.gov
Open sourcemicrosoft.com
Open sourcemcafee.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026
Emotet remained a major malware delivery platform even after international authorities disrupted its botnet infrastructure, with investigators linking it to infections on roughly **1.6 million systems** and to follow-on malware including **TrickBot**, **IcedID**, **AZORult**, and ransomware. Security research described a resilient, modular architecture in which a loader decrypted in-memory DLL modules for spamming, credential theft, Outlook harvesting, and proxying, while operators maintained parallel command-and-control infrastructures and rotated keys to complicate tracking. Campaigns commonly began with phishing emails, hijacked threads, or themed lures such as COVID-19 notices, invoices, jobs, and shipping messages, then used obfuscated Office documents, PowerShell, and `rundll32.exe` to install persistence, move payloads into randomized paths, and exfiltrate data over encrypted web traffic. After the 2021 law-enforcement action, Emotet re-emerged with updated tooling and repeatedly changed its initial access methods to preserve infection rates. Researchers observed new loaders that decrypted embedded payloads directly, stronger obfuscation, possible movement from HTTP to **HTTPS** using cryptographic libraries, and continued runtime unpacking that hindered static detection. The operators also adapted to Microsoft’s macro restrictions by testing **XLL** files, then shifting from Word attachments to **OneNote**, **WSF**, **VBScript**, and later **JavaScript** downloaders delivered through ZIP archives or cloud-storage links. Additional telemetry showed ongoing changes in bot behavior, including altered spambot SMTP formatting, underscoring that Emotet’s operators continued to refine both malware internals and large-scale email distribution tactics.
Aug 15, 2026
**Emotet** grew from a banking trojan into one of the most widely used malware delivery platforms, spreading mainly through phishing emails, hijacked reply chains, malicious Word and Excel attachments, and links that launched multi-stage infection chains. Researchers and government agencies reported that the malware stole email content, contacts, browser and mail credentials, and even reused stolen attachments to make lures more convincing, while also moving laterally inside Windows networks and maintaining persistence through services, registry changes, and in-memory modules. Campaigns increasingly abused legitimate tools such as `mshta.exe`, `cmd.exe`, `PowerShell`, `rundll32.exe`, and even process hollowing of renamed `certutil.exe` to evade detection. The botnet became a critical **initial access** source for follow-on malware and ransomware, delivering payloads including **TrickBot, QakBot, Dridex, IcedID, Gootkit, Ryuk, Conti, ProLock,** and **BitPaymer**, prompting defenders to treat any Emotet infection as an urgent enterprise incident. An international law-enforcement operation in 2021 seized and sinkholed Emotet infrastructure and enabled victim notification and malware removal efforts, but the malware resurfaced later with updated tradecraft, including revised cryptography based on **ECDH/ECDSA**, newer Windows crypto APIs, stronger obfuscation, and renewed spam campaigns using malicious Excel files and macros. Security groups such as **Cryptolaemus**, national CERTs, and vendors continued publishing indicators and response guidance as organizations remained exposed to credential theft, secondary payloads, and ransomware deployment.
Aug 15, 2026