Emotet Malware Returns: Malspammer Strikes Again

### Executive Summary This report details an active Emotet malspam campaign (September 2020) that distributes malicious Office documents prompting users to enable macros; those macros invoke PowerShell to retrieve a packed Emotet payload which persists under %AppData% and communicates with remote C2 servers. The document provides infection-chain TTPs and extensive IOCs including file hashes, malicious URLs, domains and IP addresses to aid detection and mitigation.