Emotet re-emerges after the holidays
Summary: Cisco Talos discovered several new Emotet email campaigns after a lull in distribution that corresponded with Orthodox Christmas in some regions, using malicious Word attachments with embedded macros or direct URL downloads to deliver the banking trojan. The new strain checks whether the sending IP is already on spam blocklists such as SpamCop, Spamhaus, and SORBS, and the downloader invokes PowerShell to fetch a PE32 executable from multiple URLs hosted mostly on compromised websites.
What's compelling: Emotet's new blocklist check is built to get more mail past spam filters, and its modular payloads include banking trojans, stealers, email harvesters, and ransomware chosen to monetize whatever environment the infected system sits in.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026