Loading story…
Emotet continued to evolve from a banking trojan into a resilient modular malware platform, using phishing and thread-hijacked emails to deliver malicious Office files, password-protected ZIP archives, oversized documents, OneNote attachments, and later .LNK shortcut files. Multiple analyses showed operators repeatedly changing initial access and execution methods: older campaigns relied on VBA or XLM macros, while later waves used embedded VBScript, JavaScript, and shortcut-based loaders to fetch DLL payloads from hard-coded URLs and execute them with LOLBins such as regsvr32.exe, rundll32.exe, wscript.exe, cmd.exe, PowerShell, and certutil.exe. Researchers also documented a shift from earlier "Project X" payloads to a newer "Project Y" core DLL, alongside continued use of thread hijacking and downloader chains designed to blend into normal Windows activity.
Technical reporting showed Emotet actively bypassing common defenses and maintaining a mature post-infection capability set. One Word-document sample used WMI so that cmd.exe was spawned by WmiPrvSe.exe instead of directly by Word, sidestepping Microsoft Defender's Office child-process Attack Surface Reduction rule; another macro deobfuscated strings, launched WMI-backed process creation, and ran a base64-encoded PowerShell downloader. Across samples, the malware established persistence through Registry Run keys or Windows services depending on privilege level, used process hollowing, browser credential theft modules, encrypted command-and-control with embedded RSA/AES or ECC-based protections, and rotated hard-coded C2 infrastructure. Defenders were advised to block password-protected archives and macro-enabled documents where possible, hunt for WMI-originated process creation, and monitor for suspicious use of regsvr32.exe, rundll32.exe, and other LOLBins tied to Emotet delivery chains.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
In its March 2023 resurgence, Emotet used heavily padded Microsoft Word documents with malicious macros as an initial infection vector.
Trellix reported that Emotet resumed operations in March 2023 after a short break, continuing activity with epoch 4 and epoch 5 variants.
Later in 2023, Emotet moved from malicious Word documents to Microsoft OneNote files with embedded VBScript or JavaScript after Microsoft blocked macros by default in internet-downloaded Office files.
Around April 22, 2022, Emotet operators changed tactics to use malicious Windows shortcut files that extracted embedded VBScript, downloaded a DLL from one of seven URLs, and executed it with regsvr32.
Researchers observed a new Emotet campaign on February 21, 2022 that introduced a new core payload called Y.dll, referred to as Project Y, delivered via password-protected ZIP files containing malicious Excel documents.
Trellix reported that after returning in late 2021, Emotet increased its operations during 2022.
By January 2022, researchers observed Emotet spam campaigns using malicious Excel 4.0 macro documents that launched cmd.exe and mshta.exe to fetch HTA payloads from URLs containing hexadecimal or octal IP address formats. The technique was assessed as an evasion method against pattern-based detection because operating systems normalized the nonstandard IPs into standard dotted-decimal addresses.
By December 15, 2021, Emotet had started deploying Cobalt Strike beacons on compromised hosts, expanding its post-infection tooling.
Emotet resumed operations on November 15, 2021, marking its return after the January 2021 botnet disruption.
Analysis of a January 2021 Emotet Word document showed its VBA macro launching cmd.exe through WMI so the parent process became WmiPrvSe.exe, bypassing the Defender ASR rule meant to block Office child processes.
Law enforcement agencies carried out a major disruption of Emotet infrastructure in January 2021, including a Europol-backed takedown effort.
An Emotet email campaign using malicious zipped documents was observed around 20 December 2020, including Italian-language phishing emails in the analyzed case.
A new Emotet version was observed around mid-September 2019, and researchers found three new RSA keys replacing the two previously seen botnets, indicating infrastructure reorganization into new Epochs.
Around the end of August 2019, Emotet command-and-control servers came back online following the earlier operational pause.
Emotet activity paused for about two months after its command-and-control servers went down in late May 2019.
A malicious Word document received on February 1, 2019 used VBA macros to launch a hidden PowerShell downloader that iterated through multiple URLs, saved a payload as C:\windows\temp\putty.exe, and executed it. Analysis of a misconfigured delivery site also exposed server-side PHP used to decode and serve the Emotet payload while tracking victim operating-system statistics.
Check Point reported that Emotet's original banking module was removed at some point in 2017, reflecting its shift toward modular downloader and botnet operations.
Emotet first appeared in 2014 as a banking trojan targeting financial institutions before later evolving into a broader malware delivery platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourcecynet.com
Open sourcezscaler.com
Open sourcemaxkersten.nl
Open sourceblog.vincss.net
Open sourcegithub.com
Open sourceisc.sans.edu
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026
Emotet remained a major malware delivery platform even after international authorities disrupted its botnet infrastructure, with investigators linking it to infections on roughly **1.6 million systems** and to follow-on malware including **TrickBot**, **IcedID**, **AZORult**, and ransomware. Security research described a resilient, modular architecture in which a loader decrypted in-memory DLL modules for spamming, credential theft, Outlook harvesting, and proxying, while operators maintained parallel command-and-control infrastructures and rotated keys to complicate tracking. Campaigns commonly began with phishing emails, hijacked threads, or themed lures such as COVID-19 notices, invoices, jobs, and shipping messages, then used obfuscated Office documents, PowerShell, and `rundll32.exe` to install persistence, move payloads into randomized paths, and exfiltrate data over encrypted web traffic. After the 2021 law-enforcement action, Emotet re-emerged with updated tooling and repeatedly changed its initial access methods to preserve infection rates. Researchers observed new loaders that decrypted embedded payloads directly, stronger obfuscation, possible movement from HTTP to **HTTPS** using cryptographic libraries, and continued runtime unpacking that hindered static detection. The operators also adapted to Microsoft’s macro restrictions by testing **XLL** files, then shifting from Word attachments to **OneNote**, **WSF**, **VBScript**, and later **JavaScript** downloaders delivered through ZIP archives or cloud-storage links. Additional telemetry showed ongoing changes in bot behavior, including altered spambot SMTP formatting, underscoring that Emotet’s operators continued to refine both malware internals and large-scale email distribution tactics.
Aug 15, 2026
**Emotet** grew from a banking trojan into one of the most widely used malware delivery platforms, spreading mainly through phishing emails, hijacked reply chains, malicious Word and Excel attachments, and links that launched multi-stage infection chains. Researchers and government agencies reported that the malware stole email content, contacts, browser and mail credentials, and even reused stolen attachments to make lures more convincing, while also moving laterally inside Windows networks and maintaining persistence through services, registry changes, and in-memory modules. Campaigns increasingly abused legitimate tools such as `mshta.exe`, `cmd.exe`, `PowerShell`, `rundll32.exe`, and even process hollowing of renamed `certutil.exe` to evade detection. The botnet became a critical **initial access** source for follow-on malware and ransomware, delivering payloads including **TrickBot, QakBot, Dridex, IcedID, Gootkit, Ryuk, Conti, ProLock,** and **BitPaymer**, prompting defenders to treat any Emotet infection as an urgent enterprise incident. An international law-enforcement operation in 2021 seized and sinkholed Emotet infrastructure and enabled victim notification and malware removal efforts, but the malware resurfaced later with updated tradecraft, including revised cryptography based on **ECDH/ECDSA**, newer Windows crypto APIs, stronger obfuscation, and renewed spam campaigns using malicious Excel files and macros. Security groups such as **Cryptolaemus**, national CERTs, and vendors continued publishing indicators and response guidance as organizations remained exposed to credential theft, secondary payloads, and ransomware deployment.
Aug 15, 2026