Emotet Resumes Spam Operations, Switches to OneNote

• Emotet resumed spamming operations on March 7, 2023, after a months-long hiatus.
• Initially leveraging heavily padded Microsoft Word documents to attempt to evade sandbox analysis and endpoint protection, the botnets switched to distributing malicious OneNote documents on March 16.
• Since returning, Emotet has leveraged several distinct infection chains, indicating that

analysis botnets documents emotet endpoint endpoint protection evade infection malicious march microsoft microsoft word onenote operations protection resumes sandbox spam spamming switches threat advisory word