Loading story…
Researchers reported that the Emotet malware operation resumed activity and updated its tooling to use binary padding as an evasion method. The change alters the size and structure of malicious binaries to make detection and analysis harder, helping the malware slip past security controls that rely on file signatures, static characteristics, or size-based heuristics.
Emotet has long been used as a malware delivery platform for follow-on infections, and the latest campaign shows the operators continuing to refine tradecraft rather than relying on older tooling. The updated samples indicate an effort to improve persistence and delivery success against defended environments, reinforcing the need for organizations to monitor for refreshed indicators, strengthen email and endpoint defenses, and hunt for suspicious loader activity associated with Emotet infections.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research stating that Emotet had returned and was using binary padding as an evasion technique. No earlier event details are provided in the reference content.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that malware operators, including **Emotet** and **QBot**, have increasingly used **binary padding** to evade sandbox analysis and frustrate reverse engineering by inflating portable executable files with junk data while preserving functionality. The technique alters file hashes and can be applied through PE overlays, padded resource sections, gaps between sections, or oversized variables; low-entropy bytes such as repeated `00` values are especially effective because they compress well inside ZIP archives. Researchers also highlighted a compressed-padding variant known as **PufferPhishing**, which produces unusually large binaries that remain practical to deliver through phishing attachments. Emotet campaigns illustrate how the tactic fits into broader phishing-driven intrusion chains. Recent outbreaks used malicious Office documents and Excel 4.0 macros to trick users into enabling content, then downloaded DLL payloads from hardcoded or macro-generated URLs and executed them with tools such as **`regsvr32.exe`** or **`rundll32.exe`**. In one documented case, an Emotet DLL grew from about **616 KB** to **548.1 MB** through `00`-byte padding before being compressed for delivery, while post-infection activity included credential theft, spam distribution, reconnaissance, and process hollowing. Historical reporting also tied payload inflation to groups such as **BRONZE BUTLER**, showing that file-padding and oversized-payload evasion have been used across multiple malware operations for years.
Aug 15, 2026
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026
Emotet remained a major malware delivery platform even after international authorities disrupted its botnet infrastructure, with investigators linking it to infections on roughly **1.6 million systems** and to follow-on malware including **TrickBot**, **IcedID**, **AZORult**, and ransomware. Security research described a resilient, modular architecture in which a loader decrypted in-memory DLL modules for spamming, credential theft, Outlook harvesting, and proxying, while operators maintained parallel command-and-control infrastructures and rotated keys to complicate tracking. Campaigns commonly began with phishing emails, hijacked threads, or themed lures such as COVID-19 notices, invoices, jobs, and shipping messages, then used obfuscated Office documents, PowerShell, and `rundll32.exe` to install persistence, move payloads into randomized paths, and exfiltrate data over encrypted web traffic. After the 2021 law-enforcement action, Emotet re-emerged with updated tooling and repeatedly changed its initial access methods to preserve infection rates. Researchers observed new loaders that decrypted embedded payloads directly, stronger obfuscation, possible movement from HTTP to **HTTPS** using cryptographic libraries, and continued runtime unpacking that hindered static detection. The operators also adapted to Microsoft’s macro restrictions by testing **XLL** files, then shifting from Word attachments to **OneNote**, **WSF**, **VBScript**, and later **JavaScript** downloaders delivered through ZIP archives or cloud-storage links. Additional telemetry showed ongoing changes in bot behavior, including altered spambot SMTP formatting, underscoring that Emotet’s operators continued to refine both malware internals and large-scale email distribution tactics.
Aug 15, 2026