Emotet Malware back in Action

Cyble Research Labs reports Emotet’s resurgence in late 2021–2022, documenting phishing campaigns that deliver malicious Excel attachments (including password-protected ZIPs) which execute hidden macros to download and run Emotet DLLs via multiple infection chains (mshta→PowerShell→rundll32, WScript→VBS/BAT→PowerShell, regsvr32), notes upgrades such as ECC usage and Cobalt Strike deployment, and provides extensive IOCs (file hashes, download URLs, and C2 domains) and mitigation recommendations.