Malware operation Emotet is once again distributing malicious emails after nearly five months of “holiday” when the notorious cybercriminal operation was inactive.

Emotet is malware that spreads through phishing campaigns containing malicious Excel or Word documents. When users open these documents and enable macros, the Emotet DLL will be downloaded and loaded into memory.

Once downloaded, the malware searches and intercepts emails for use in future spam campaigns and removes additional payloads such as Cobalt Strike or other malware that often leads to ransomware attacks. Although Emotet was considered the most common malware in the past, it suddenly stopped sending spam on June 13, 2022.

Researchers from the Emotet Cryptolaemus Research Group reported that on November 2, at 4:00 ET, the Emotet operation was suddenly revived, sending spam to email addresses around the world.

Proofpoint threat researcher and Cryptolaemus member Tommy Majar told BleepingComputer that modern Emotet email campaigns use compromised email chains to distribute malicious Excel attachments. Of the samples uploaded to VirusTotal, BleepingComputer has seen attachments targeting users around the world under various languages ​​and filenames, appearing as invoices, scans, electronic forms, and other traps. Source