Back 
Summary
Emotet is undoubtedly a very resilient botnet. Even though its operation was disrupted by Europol in January 2021, Emotet came back a few months later and continues to spread. In May 2022, shortly after Microsoft released new controls related to malicious macros, Netskope Threat Labs analyzed an Emotet campaign where they were testing a new delivery method, by using LNK files. Later, Netskope Threat Labs found a new campaign in June 2022 where Emotet continued to use Microsoft Office files to spread its payloads.
After another brief hiatus, a new Emotet campaign was spotted in March 2023, where attackers are still using Microsoft Office files as a delivery method. While there are also no notable differences in its main payload, the attackers behind Emotet have added a technique that increases the file size to bypass security solutions that do not scan large files. In this blog post, we will analyze this Emotet campaign from the deliver