Threat Source newsletter (May 5, 2022) — Emotet is using up all of its nine lives
Summary: Cisco Talos argues Emotet never truly went away after last year's international law enforcement takedown, noting the botnet resumed sending spam roughly nine months after the announcement and that no arrests were made. The newsletter also cites new Talos research on leaked Conti and Hive ransomware chat logs, and reports that Chinese state-sponsored APT41 has been in more than 30 major companies' networks for over two years under "Operation Cuckoo Bees."
Why it matters: The takedown produced no arrests, so the operators remained free to rebuild - and Emotet's pattern of months-long pauses means another reappearance should surprise no one, which is why Talos says defenders can never treat a threat as gone no matter how impressive the press release sounds.
Read the original at Cisco Talos ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026