Emotet Strikes Again, Resuming Spamming Operations

**Executive summary:** The Emotet botnet resumed operations on March 7, 2023, distributing spam with ZIP attachments that contain oversized DOC files (ZIP-bombing) which prompt users to enable macros; those macros retrieve a >500MB Emotet DLL from listed URLs, install it under %LOCALAPPDATA% and execute it via regsvr32.exe, enabling C2 communication and delivery of secondary payloads. The report provides geographic campaign observations, IOCs (hashes, URLs), MITRE ATT&CK mappings, and recommended mitigations to reduce exposure.