Loading story…
Emotet operators resumed large-scale phishing activity by sending emails from compromised organizational mail servers and using spoofed display names, reply-style subject lines, and topical lures such as IRS tax notices. Multiple reports found the messages commonly carried password-protected ZIP archives containing malicious Excel files with legacy Excel 4.0/XLM macros. After a user enabled editing or macros, the spreadsheet downloaded an Emotet payload from compromised or attacker-controlled URLs and launched it with regsvr32.exe, restoring Emotet’s foothold after its earlier disruption.
Researchers observed that infected hosts then contacted multiple Emotet command-and-control servers and could be repurposed as spambots to send additional phishing emails with malicious spreadsheet attachments, extending the campaign. Analysis across the reports identified packed DLL or OCX payloads, Windows service persistence, and follow-on risk including delivery of tools such as Cobalt Strike or SystemBC. The references also published hunting and detection material, including Microsoft 365 Defender KQL queries, file hashes, domains, IP addresses, and JA3/JA3S TLS fingerprints, while noting that the campaigns continued to succeed partly because some environments still allowed Office macros despite Microsoft hardening changes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
From 18 URLs extracted from the malicious spreadsheets, Netskope found four still online and delivering Emotet at the time of analysis, and extracted three different 64-bit DLL payloads.
Netskope found 776 malicious Excel spreadsheets submitted to VirusTotal between June 9 and June 21 that abused Excel 4.0 macros to download and execute Emotet payloads.
Netskope said it had previously analyzed an April 2022 Emotet campaign that used LNK files instead of Microsoft Office documents.
As of March 23, NVISO said the Emotet malspam campaign that began on March 10 was still ongoing, though its frequency appeared to be decreasing.
NVISO observed a large Emotet malspam campaign beginning on March 10 that used compromised organizational mail servers, spoofed display names, and password-protected ZIP files containing macro-enabled Excel documents.
Fortinet reported that several transactions had been made to the Bitcoin wallet used in the Ukraine-themed donation scam since the campaign was discovered on March 7.
Palo Alto Unit 42 shared screenshots and indicators of compromise from an Emotet infection, which later supported additional traffic analysis.
The domain seca[.]cam, later used in a Ukraine-themed donation scam impersonating the United Nations, was registered.
Microsoft announced in January 2022 that Excel 4.0 macros were disabled by default starting in Excel build 16.0.14427.10000.
Emotet returned and resumed targeting organizations globally across multiple sectors following the 2021 disruption.
Europol and other law enforcement authorities disrupted Emotet, after which Emotet malicious spam and phishing activity dropped significantly for several months.
Fortinet noted that Microsoft moved to restrict VBA macros by default in Access, Excel, PowerPoint, Visio, and Word starting in April 2022.
FortiGuard Labs documented an IRS-impersonation phishing campaign delivering Emotet via a password-protected ZIP archive containing an Excel 4.0 macro-enabled file that downloaded malware from multiple remote locations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
netskope.com
Open sourcenetresec.com
Open sourceblog.nviso.eu
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026
Emotet continued to evolve from a banking trojan into a resilient modular malware platform, using phishing and thread-hijacked emails to deliver malicious Office files, password-protected ZIP archives, oversized documents, OneNote attachments, and later `.LNK` shortcut files. Multiple analyses showed operators repeatedly changing initial access and execution methods: older campaigns relied on VBA or XLM macros, while later waves used embedded VBScript, JavaScript, and shortcut-based loaders to fetch DLL payloads from hard-coded URLs and execute them with LOLBins such as `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `cmd.exe`, `PowerShell`, and `certutil.exe`. Researchers also documented a shift from earlier "Project X" payloads to a newer "Project Y" core DLL, alongside continued use of thread hijacking and downloader chains designed to blend into normal Windows activity. Technical reporting showed Emotet actively bypassing common defenses and maintaining a mature post-infection capability set. One Word-document sample used WMI so that `cmd.exe` was spawned by `WmiPrvSe.exe` instead of directly by Word, sidestepping Microsoft Defender's Office child-process Attack Surface Reduction rule; another macro deobfuscated strings, launched WMI-backed process creation, and ran a base64-encoded PowerShell downloader. Across samples, the malware established persistence through Registry Run keys or Windows services depending on privilege level, used process hollowing, browser credential theft modules, encrypted command-and-control with embedded RSA/AES or ECC-based protections, and rotated hard-coded C2 infrastructure. Defenders were advised to block password-protected archives and macro-enabled documents where possible, hunt for WMI-originated process creation, and monitor for suspicious use of `regsvr32.exe`, `rundll32.exe`, and other LOLBins tied to Emotet delivery chains.
Aug 15, 2026
Emotet remained a major malware delivery platform even after international authorities disrupted its botnet infrastructure, with investigators linking it to infections on roughly **1.6 million systems** and to follow-on malware including **TrickBot**, **IcedID**, **AZORult**, and ransomware. Security research described a resilient, modular architecture in which a loader decrypted in-memory DLL modules for spamming, credential theft, Outlook harvesting, and proxying, while operators maintained parallel command-and-control infrastructures and rotated keys to complicate tracking. Campaigns commonly began with phishing emails, hijacked threads, or themed lures such as COVID-19 notices, invoices, jobs, and shipping messages, then used obfuscated Office documents, PowerShell, and `rundll32.exe` to install persistence, move payloads into randomized paths, and exfiltrate data over encrypted web traffic. After the 2021 law-enforcement action, Emotet re-emerged with updated tooling and repeatedly changed its initial access methods to preserve infection rates. Researchers observed new loaders that decrypted embedded payloads directly, stronger obfuscation, possible movement from HTTP to **HTTPS** using cryptographic libraries, and continued runtime unpacking that hindered static detection. The operators also adapted to Microsoft’s macro restrictions by testing **XLL** files, then shifting from Word attachments to **OneNote**, **WSF**, **VBScript**, and later **JavaScript** downloaders delivered through ZIP archives or cloud-storage links. Additional telemetry showed ongoing changes in bot behavior, including altered spambot SMTP formatting, underscoring that Emotet’s operators continued to refine both malware internals and large-scale email distribution tactics.
Aug 15, 2026