August 22, 2022

Emotet Resurgence: Cross-Industry Analysis

Technical insights on the Emotet resurgence in 2022 across various client environments, industries, and regions.

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Eugene Chua

Cyber Security Analyst

Aug 2022

Introduction

Last year provided further evidence that the cyber threat landscape remains both complex and challenging to predict. Between uncertain attribution, novel exploits and rapid malware developments, it is becoming harder to know where to focus security efforts. One of the largest surprises of 2021 was the re-emergence of the infamous Emotet botnet. This is an example of a campaign that ignored industry verticals or regions and seemingly targeted companies indiscriminately. Only 10 months after the Emotet takedown by law enforcement agencies in January, new Emotet activities in November were discovered by security researchers. These continued into the first quarter of 2022, a period which this blog will explore through findings from the Darktrace Threat Intel Unit.

Dating back to 2019, Emotet was known to deliver Trickbot payloads which ultimately deployed Ryuk ransomware strains on compromised devices. This interconnectivity highlighted the hydra-like nature of threat groups wherein eliminating one (even with full-scale law enforcement intervention) would not rule them out as a threat nor indicate that the threat landscape would be any more secure.

When Emotet resurged, as expected, one of the initial infection vectors involved leveraging existing Trickbot infrastructure. However, unlike the original attacks, it featured a brand new phishing campaign.

Figure 1: Distribution of observed Emotet activities across Darktrace deployments

Although similar to the original Emotet infections, the new wave of infections has been classified into two categories: Epochs 4 and 5. These had several key differences compared to Epochs 1 to 3. Within Darktrace’s global deployments, Emotet compromises associated to Epoch 4 appeared to be the most prevalent. Affected customer environments were seen within a large range of countries (Figure 1) and industry verticals such as manufacturing and supply chain, hospitality and travel, public administration, technology and telecoms and healthcare. Company demographics and size did not appear to be a targeting factor as affected customers had varying employee counts ranging from less than 250, to over 5000.

Key differences between Epochs 1-3 vs 4-5

Based on wider security research into the innerworkings of the Emotet exploits, several key differences were identified between Epochs 4/5 and its predecessors. The newer epochs used:

· A different Microsoft document format (OLE vs XML-based).

· A different encryption algorithm for communication. The new epochs used Elliptic Curve Cryptograph (ECC) [1] with public encryption keys contained in the C2 configuration file [2]. This was different from the previous Rivest-Shamir-Adleman (RSA) key encryption method.

· Control Flow Flattening was used as an obfuscation technique to make detection and reverse engineering more difficult. This is done by hiding a program’s control flow [3].

· New C2 infrastructure was observed as C2 communications were directed to over 230 unique IPs all associated to the new Epochs 4 and 5.

In addition to the new Epoch 4 and 5 features, Darktrace detected unsurprising similarities in those deployments affected by the renewed campaign. This included self-signed SSL connections to Emotet’s new infrastructure as well as malware spam activities to multiple rare external endpoints. Preceding these outbound communications, devices across multiple deployments were detected downloading Emotet-associated payloads (algorithmically generated DLL files).

Emotet Resurgence Campaign

Figure 2: Darktrace’s Detection Timeline for Emotet Epoch 4 and 5 compromises

1. Initial Compromise

The initial point of entry for the resurgence activity was almost certainly via Trickbot infrastructure or a successful phishing attack (Figure 2). Following the initial intrusion, the malware strain begins to download payloads via macro-ladened files which are used to spawn PowerShell for subsequent malware downloads.

Following the downloads, malicious communication with Emotet’s C2 infrastructure was observed alongside activities from the spam module. Within Darktrace, key techniques were observed and documented below.

2. Establish Foothold: Binary Dynamic-link library (.dll) with algorithmically generated filenames

Emotet payloads are polymorphic and contain algorithmically generated filenames . Within deployments, HTTP GET requests involving a suspicious hostname, www[.]arkpp[.]com, and Emotet related samples such as those seen below were observed:

· hpixQfCoJb0fS1.dll (SHA256 hash: 859a41b911688b00e104e9c474fc7aaf7b1f2d6e885e8d7fbf11347bc2e21eaa)

· M0uZ6kd8hnzVUt2BNbRzRFjRoz08WFYfPj2.dll (SHA256 hash: 9fbd590cf65cbfb2b842d46d82e886e3acb5bfecfdb82afc22a5f95bda7dd804)

· TpipJHHy7P.dll (SHA256 hash: 40060259d583b8cf83336bc50cc7a7d9e0a4de22b9a04e62ddc6ca5dedd6754b)

These DLL files likely represent the distribution of Emotet loaders which depends on windows processes such as rundll32[.]exe and regsvr32[.]exe to execute.

3. Establish Foothold: Outbound SSL connections to Emotet C2 servers

A clear network indicator of compromise for Emotet’s C2 communication involved self-signed SSL using certificate issuers and subjects which matched ‘CN=example[.]com,OU=IT Department,O=Global Security,L=London,ST=London,C=GB’ , and a common JA3 client fingerprint (72a589da586844d7f0818ce684948eea). The primary C2 communications were seen involving infrastructures classified as Epoch 4 rather than 5. Despite encryption in the communication content, network contextual connection details were sufficient for the detection of the C2 activities (Figure 3).

Figure 3: UI Model Breach logs on download and outbound SSL activities.

Outbound SSL and SMTP connections on TCP ports 25, 465, 587

An anomalous user agent such as, ‘Microsoft Outlook 15.0’, was observed being used for SMTP connections with some subject lines of the outbound emails containing Base64-encoded strings. In addition, this JA3 client fingerprint (37cdab6ff1bd1c195bacb776c5213bf2) was commonly seen from the SSL connections. Based on the set of malware spam hostnames observed across at least 10 deployments, the majority of the TLDs were .jp, .com, .net, .mx, with the Japanese TLD being the most common (Figure 4).

Figure 4: Malware Spam TLDs observed in outbound SSL and SMTP

Plaintext spam content generated from the spam module were seen in PCAPs (Figure 5). Examples of clear phishing or spam indicators included 1) mismatched personal header and email headers, 2) unusual reply chain and recipient references in the subject line, and 3) suspicious compressed file attachments, e.g. Electronic form[.]zip.

Figure 5: Example of PCAP associated to SPAM Module

4. Accomplish Mission

The Emotet resurgence also showed through secondary compromises involving anomalous SMB drive writes related to CobaltStrike. This consistently included the following JA3 hash (72a589da586844d7f0818ce684948eea) seen in SSL activities as well as SMB writes involving the svchost.exe file.

Darktrace Detection

The key DETECT models used to identify Emotet Resurgence activities were focused on determining possible C2. These included:

· Suspicious SSL Activity

· Suspicious Self-Signed SSL

· Rare External SSL Self-Signed

· Possible Outbound Spam

File-focused models were also beneficial and included:

· Zip or Gzip from Rare External Location

· EXE from Rare External Location

Darktrace’s detection capabilities can also be shown through a sample of case studies identified during the Threat Research team’s investigations.

Case Studies

Darktrace’s detection of Emotet activities was not limited by industry verticals or company sizing. Although there were many similar features seen across the new epoch, each incident displayed varying techniques from the campaign. This is shown in two client environments below:

When investigating a large customer environment within the public administration sector, 16 different devices were detected making 52,536 SSL connections with the example[.]com issuer. Devices associated with this issuer were mainly seen breaching the same Self-Signed and Spam DETECT models. Although anomalous incoming octet-streams were observed prior to this SSL, there was no clear relation between the downloads and the Emotet C2 connections. Despite the total affected devices occupying only a small portion of the total network, Darktrace analysts were able to filter against the much larger network ‘noise’ and locate detailed evidence of compromise to notify the customer.

Darktrace also identified new Emotet activities in much smaller customer environments. Looking at a company in the healthcare and pharmaceutical sector, from mid-March 2022 a single internal device was detected making an HTTP GET request to the host arkpp[.]com involving the algorithmically-generated DLL, TpipJHHy7P.dll with the SHA256 hash: 40060259d583b8cf83336bc50cc7a7d9e0a4de22b9a04e62ddc6ca5dedd6754b (Figure 6).

Figure 6: A screenshot from VirusTotal, showing that the SHA256 hash has been flagged as malicious by other security vendors.

After the sample was downloaded, the device contacted a large number of endpoints that had never been contacted by devices on the network. The endpoints were contacted over ports 443, 8080, and 7080 involving Emotet related IOCs and the same SSL certificate mentioned previously. Malware spam activities were also observed during a similar timeframe.

The Emotet case studies above demonstrate how autonomous detection of an anomalous sequence of activities - without depending on conventional rules and signatures - can reveal significant threat activities. Though possible staged payloads were only seen in a proportion of the affected environments, the following outbound C2 and malware spam activities involving many endpoints and ports were sufficient for the detection of Emotet.

If present, in both instances Darktrace’s Autonomous Response technology, RESPOND, would recommend or implement surgical actions to precisely target activities associated with the staged payload downloads, outgoing C2 communications, and malware spam activities. Additionally, restriction to the devices’ normal pattern of life will prevent simultaneously occurring malicious activities while enabling the continuity of normal business operations.

Conclusion

· The technical differences between past and present Emotet strains emphasizes the versatility of malicious threat actors and the need for a security solution that is not reliant on signatures.

· Darktrace’s visibility and unique behavioral detection continues to provide visibility to network activities related to the novel Emotet strain without reliance on rules and signatures. Key examples include the C2 connections to new Emotet infrastructure.

· Looking ahead, detection of C2 establishment using suspicious DLLs will prevent further propagation of the Emotet strains across networks.

· Darktrace’s AI detection and response will outpace conventional post compromise research involving the analysis of Emotet strains through static and dynamic code analysis, followed by the implementation of rules and signatures.

Thanks to Paul Jennings and Hanah Darley for their contributions to this blog.

Appendices

Model breaches

· Anomalous Connection / Anomalous SSL without SNI to New External

· Anomalous Connection / Application Protocol on Uncommon Port

· Anomalous Connection / Multiple Connections to New External TCP Port

· Anomalous Connection / Multiple Failed Connections to Rare Endpoint

· Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

· Anomalous Connection / Possible Outbound Spam

· Anomalous Connection / Rare External SSL Self-Signed

· Anomalous Connection / Repeated Rare External SSL Self-Signed

· Anomalous Connection / Suspicious Expired SSL

· Anomalous Connection / Suspicious Self-Signed SSL

· Anomalous File / Anomalous Octet Stream (No User Agent)

· Anomalous File / Zip or Gzip from Rare External Location

· Anomalous File / EXE from Rare External Location

· Compromise / Agent Beacon to New Endpoint

· Compromise / Beacon to Young Endpoint

· Compromise / Beaconing Activity To External Rare

· Compromise / New or Repeated to Unusual SSL Port

· Compromise / Repeating Connections Over 4 Days

· Compromise / Slow Beaconing Activity To External Rare

· Compromise / SSL Beaconing to Rare Destination

· Compromise / Suspicious Beaconing Behaviour

· Compromise / Suspicious Spam Activity

· Compromise / Suspicious SSL Activity

· Compromise / Sustained SSL or HTTP Increase

· Device / Initial Breach Chain Compromise

· Device / Large Number of Connections to New Endpoints

· Device / Long Agent Connection to New Endpoint

· Device / New User Agent

· Device / New User Agent and New IP

· Device / SMB Session Bruteforce

· Device / Suspicious Domain

· Device / Suspicious SMB Scanning Activity

‍

For Darktrace customers who want to know more about using Darktrace to triage Emotet, refer here for an exclusive supplement to this blog.

References

[1] https://blog.lumen.com/emotet-redux/

[2] https://blogs.vmware.com/security/2022/03/emotet-c2-configuration-extraction-and-analysis.html

[3] https://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/

Written by

Eugene Chua

Cyber Security Analyst

Inside the SOC

Written by

Eugene Chua

Cyber Security Analyst

Malware Research Lead

Proactive Security

•

June 2, 2026

Watch the NIS2 Webinar

Blog

Proactive Security

June 2, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Núclea is a Brazilian data and technology company that supports the country’s financial system by delivering digital services exclusively to banks and financial institutions. Operating in an environment where trust, availability, and data integrity are critical, the company faces a threat landscape that has evolved rapidly—particularly with the rise of AI-driven cyberattacks.

Brazil has experienced a wave of successful cyber incidents targeting financial institutions, many of them enabled by insiders or compromised credentials. The result was a noticeable shift in attacker strategy: instead of focusing on end customers, threat actors began targeting the institutions and platforms that underpin the financial ecosystem itself.

“Attacks became far more directed and contextual,” explains Guilherme, who leads incident response within Núclea’s security platform engineering team. “They weren’t noisy or obviously malicious—they were precise, patient, and designed to blend into normal operations.”

That precision was on full display in January 2026, when Núclea faced one of the most convincing phishing attacks the team had seen.

A real attack, built on trust and context

The attack began with a seemingly routine email.

It was sent from a real Brazilian government institution, using legitimate infrastructure and valid credentials that were later confirmed to have been compromised. Núclea had an established, ongoing relationship with this organization, and the email’s language, tone, and subject matter aligned perfectly with the type of communication the recipient team handled every day.

Attached to the email was a PDF document containing content that looked entirely legitimate.

The problem? A single URL embedded inside that PDF.

“The message itself was correct. The sender was real. The context was familiar. Even the document content made sense,” Guilherme explains. “There was just one small element that didn’t belong.”

That small detail was enough to initiate a full attack chain.

What the attackers were trying to do

If clicked, the URL would have downloaded a malicious payload designed to:

Collect information about the user and device
Identify where the system was located within the financial ecosystem
Install remote access tools to maintain control
Deploy an infostealer to extract sensitive data
Execute anti-forensic scripts to erase traces of the intrusion

In other words, it was a carefully engineered operation designed for persistence and stealth, not immediate disruption.

The attack also employed urgency—a classic social engineering technique. When the link didn’t open as expected, employees requested assistance from the security team, insisting the document was important and needed to be accessed quickly.

This is precisely the kind of scenario where traditional security tools struggle: almost everything about the interaction is legitimate.

Where Darktrace made the difference

Instead of blocking the entire message or relying on known indicators of compromise, Darktrace focused on behavioral context.

Darktrace recognized:

That the sending organization was normally trusted
That the communication pattern matched historical behavior
That the PDF content itself was not suspicious

But it also identified that the URL embedded within the document deviated from established behavioral patterns.

Rather than disrupting business operations, Darktrace took precise action: it rewrote the URL, preventing the malicious download while leaving the rest of the email untouched.

“When we analyzed it afterward, it became clear how dangerous the attack would have been,” says Guilherme. “But it never progressed—because Darktrace acted at exactly the right point.”

Subsequent forensic analysis confirmed the payload’s malicious intent. The attack never succeeded.

Precision over disruption

For Núclea, this incident reinforced a critical lesson: modern attacks don’t always look malicious—they hide within normal activity.

“What stands out to me is the precision,” Guilherme says. “Darktrace doesn’t rely on big, obvious signals. It’s effective in situations that fall outside the standard patterns we all know.”

Building resilience in a high trust ecosystem

For Núclea, cybersecurity is not just a defensive measure—it’s a business enabler.

Availability failures or successful breaches in the financial ecosystem can have immediate, large-scale consequences, from financial loss to reputational damage. Preventing those outcomes protects not just Núclea, but its partners and customers as well.

“Cyber resilience means keeping the business running—even under attack,” Guilherme explains. “And that requires people, processes, and technology working together.”

As AI continues to accelerate both attacks and defenses, the role of security is evolving. Precision, behavioral understanding, and intelligent automation are no longer optional—they’re essential.

“The easy days were yesterday,” Guilherme says. “The challenges ahead are bigger. We need to be prepared—internally and with partners that help us build resilience.”

‍

About the author

Blog

Proactive Security

June 1, 2026

Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense

Modern attacks don’t always announce themselves, follow obvious patterns, or rely on known malware. Often, they move quietly inside trusted systems, authenticated sessions, and everyday behavior.

They don’t break in. They blend in.

That’s why an AI-powered defense is essential. It turns invisible signals into actionable insights at a scale neither analysts nor traditional tools can achieve alone.

Confidence is creating risk

One of the most dangerous assumptions in cybersecurity today is that strong controls equal strong protection.

Multi-factor authentication (MFA), for example, is widely viewed as a foundational safeguard. But as the CISO for a professional sports organization explains, that confidence can be misplaced. “A lot of organizations assume that once you have MFA, those accounts are safe. That’s not true.”

In one instance, his team identified a sophisticated attack where a threat actor bypassed MFA entirely, not by breaking it, but by going around it. A user’s authenticated session was hijacked and re-used, allowing the attacker to impersonate them without triggering traditional controls.

“Darktrace picked up that a session had been re-injected by the hacker, and we were able to block it right away,” he explains.

Attackers anticipate what we miss

Even well-trained users can become entry points.

“An email bypassed our existing security tools,” shares the VP of IT at a U.S.-based risk management services provider. “The user missed one signal and entered their credentials into a malicious site. That’s what the bad guys count on.”

The organization responded quickly, but not before damage was done. Crucially, this occurred while Darktrace was in “watch mode,” before autonomous response was fully enabled. “Darktrace would have seen that and shut it down immediately,” he notes.

Mistakes and oversights like misconfigurations, forgotten machines, and missed patches can create serious vulnerabilities.

The CIO of a utility services organization shares an instance when Darktrace detected a breach to a client’s network via their ZTNA VPN due to misconfigured MFA. “Darktrace alerted us and autonomously blocked the scanning, preventing what could have been a ransomware-type incident.”

The most dangerous threats are already inside

The Head of Security at a global business services provider knows firsthand how blind spots can persist inside environments. His team uncovered evidence of dormant ransomware artifacts sitting unnoticed within a company’s environment ¬¬– long before modern detection was in place.

“During a routine file transfer, Darktrace flagged the suspicious activity, identified the ransomware, and immediately quarantined the server,” he recalls. While the attack was never executed, the implication was significant: the risk existed long before it was finally detected.

Cyber threats are also successful because they take advantage of normal human behavior, exploiting moments of cognitive overload, urgency, and trust.

The Executive Director of IT and Business Applications at a pharmaceutical lab describes the time Darktrace flagged an employee logging into Microsoft 365 from Singapore, despite him being physically located in the U.S. Darktrace immediately cut off his access and within minutes revealed that the employee’s son was using a VPN to play a video game.

While the threat was benign, it demonstrated the strength of AI to use contextual information to detect threats other tools miss. The information also saved security analysts hours of investigation and minimized downtime for the employee. “That level of precision and speed isn’t just convenient, it’s game changing.”

“Unusual” behavior is the new red flag

Detecting modern threats requires an understanding of what “normal” looks like and recognizing when something subtly deviates.

One security leader at an AI technology enterprise described a scenario in which an employee connected to a proxy service in China. The service itself was legitimate, and although traditional tools didn’t flag it, the behavior was unusual for that user specifically.

“That’s what Darktrace picked up on. The activity turned out to be benign, but without visibility into behavioral deviations, it could just as easily have been something more serious.”

AI shifts defense from reaction to anticipation

These stories point to a fundamental shift by cyber attackers, both tactically and strategically. Because traditional security tools were built to detect what’s already known, modern attacks are often:

Credential-based, not malware-based
Behavioral, not signature-based
Subtle, not overt

They may operate within the boundaries of what appears normal, exploiting what organizations trust, not what they block:

Trusted sessions
Legitimate services
Human error

This is where AI is changing the equation. Rather than relying on predefined rules or known threat signatures, AI can:

Establish a baseline of normal behavior
Detect subtle anomalies in real time
Act autonomously to contain potential threats

Resilience, not perfection, is the new security standard

As these frontline experiences show, the organizations that lead are those that move beyond reactive defense and embrace AI as a core part of their strategy.

It eliminates the blind spots and uncertainty, says the CISO of a professional sports organization. “If you lack visibility, you’re not managing risk, you’re assuming it. AI gives you the actionable insights needed to turn uncertainty into control.”

And it provides the speed and agility that are vital when seconds matter, says the Executive Director of IT and Business Applications. “When Darktrace alerted us at 3:00 am to a ransomware attack, it had already quarantined the affected systems, blocked the attacker’s access, and provided us with the critical details and time needed to investigate. That action likely saved us hundreds of thousands, if not millions, of dollars.”

The modern SOC has become a cornerstone of enterprise resilience, responsible for protecting data and operational continuity while enabling digital growth and innovation. For today’s security professional, that means success is no longer measured by what they keep out, but by what they protect: revenue, reputation, and trust.

‍

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Emotet Resurgence: Cross-Industry Analysis

Introduction

Key differences between Epochs 1-3 vs 4-5

Emotet Resurgence Campaign

Darktrace Detection

Case Studies

Conclusion

Appendices

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

Enjoying the blog?

More in this series

Blog

Proactive Security

June 2, 2026

Stopping Stealth Attacks with Precision: How Núclea Prevented a Breach Without Disruption

A real attack, built on trust and context

What the attackers were trying to do

Where Darktrace made the difference

Precision over disruption

Blog

Proactive Security

June 1, 2026

Defend What You Trust: Stories from the Front Lines of Modern Cyber Defense

They don’t break in. They blend in.

Attackers anticipate what we miss

The most dangerous threats are already inside

“Unusual” behavior is the new red flag

AI shifts defense from reaction to anticipation

Resilience, not perfection, is the new security standard