Return of Emotet malware

Emotet resurfaced in November 2021 after a law‑enforcement disruption earlier in the year; this report documents its return via TrickBot and reply‑chain email spam using .docm/.xlsm and passworded .zip attachments, notes changes such as HTTPS-based C2 and updated encryption, maps relevant MITRE ATT&CK techniques, and provides IOCs (sample hash, multiple C2 IPs/ports, public keys, and malicious URLs) for detection and mitigation.