Back from the dead: Emotet re-emerges, begins rebuilding to wrap up 2021
Summary: Emotet has re-emerged after an international police takedown in early 2021 removed its botnets from the threat landscape, with Cisco Talos observing new infrastructure and distribution campaigns as of last week. Trickbot command and control servers began instructing infected systems to retrieve and execute a new Emotet version, and new spam campaigns followed using hijacked email threads, DOCM and XLSM files, and password-protected ZIP archives to deliver a downloader that pulls the Emotet DLL.
Key Takeaway: Emotet has historically been used to drop additional malware or provide an initial foothold for adversaries conducting big game hunting style ransomware attacks, and Talos expects activity to keep growing as more systems fall under adversarial control.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026