A threat analysis published by Trellix Threat Intelligence Group documents Emotet's resurgence in early 2023, detailing new infection vectors the group adopted in response to Microsoft's macro-blocking policy — including OneNote-based droppers, heavily padded zip-bomb documents, and encrypted attachments — as the malware continued its role as both a banking trojan and a dropper-for-hire for secondary payloads.
From Takedown to Resilience
Despite a landmark January 2021 takedown coordinated by Europol that disrupted Emotet's global infrastructure, the malware (also known as Geodo and Heodo) returned by November 2021 and escalated operations through 2022 and into 2023. When Emotet resumed spam campaigns in March 2023 after a brief hiatus, it faced a changed threat landscape: Microsoft had begun blocking macros by default in documents downloaded from the internet, forcing a pivot in delivery methodology. The group's rapid adaptation illustrates the operational maturity of a threat actor that has persisted since 2014.
Three Infection Variants
Trellix identified three concurrent delivery variants in the 2023 campaigns:
- Variant 1 — Invoice-Themed Zip Bombs: Malicious ZIP files attached to fake invoice emails (with "RE:" prefixes for credibility) containing Word documents padded to over 500MB with null bytes — a binary inflation technique designed to exceed the file size limits of sandbox environments and antivirus scan engines.
- Variant 2 — OneNote Droppers: Following Microsoft's macro-blocking enforcement, Emotet switched to OneNote sections containing embedded VBScript or JavaScript that download and execute the payload. Users must explicitly approve script execution via a warning prompt, introducing a social engineering dependency.
- Variant 3 — Encrypted Attachments: Password-protected ZIP or OneNote documents with the password provided in the email body, used to bypass file-scanning detection at the email gateway layer.
Thread Hijacking: Weaponizing Trust
Emotet's most effective social engineering technique remains email thread hijacking. The malware harvests email data from infected Windows hosts and uses it to craft fake replies impersonating the original senders, inserting malicious attachments into existing legitimate email threads. This technique exploits the implicit trust of ongoing conversations and makes phishing detection significantly harder for both recipients and automated filtering systems.
Technical Execution Chain
Once a user opens and enables content in a malicious document, the execution chain proceeds through obfuscated VBA macros or embedded scripts that download the Emotet DLL from attacker-controlled servers. The payload is executed via regsvr32, which injects code into a copy of certutil.exe (process hollowing, T1055.012), uses NirSoft credential-harvesting modules like WebBrowserPassView for credential theft from browsers, establishes persistence via registry Run keys, performs system discovery via ipconfig.exe and systeminfo.exe, and communicates with hardcoded C2 servers using Elliptic Curve Cryptography (ECC) for encrypted channel communications. Trellix's global telemetry identifies the top targeted sectors as e-commerce, energy/utilities, financial services, government, and healthcare, with Estonia, Thailand, Guatemala, Israel, and Singapore among the top affected countries.