Threat reportMalwareTL-2026-3835
Emotet Awakens With New Campaign of Mass Email Exfiltration
Emotet Awakens With New Campaign of Mass Email Exfiltration (TL-2026-3835) is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Outlook (MAPI-configured profiles on Windows endpoints, maps to 10 MITRE ATT&CK techniques (T1012, T1055, T1071.001), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3835
- Threat ID
- TL-2026-3835
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, enterprise, water-utilities
- Target regions
- North America, Europe, united states of america, united kingdom, turkey, south africa
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Emotet Awakens With New Campaign of Mass Email Exfiltration
Malware and tooling: Emotet - S0367, TrickBot, Zeus Panda Banker, NirSoft Mail PassView, Trick Bot
How Emotet Awakens With New Campaign of Mass Email Exfiltration works
Kryptos Logic reported that Emotet, after roughly a month of dormancy, began delivering a new module that harvests sender, recipient, subject and body of Outlook email from the past 180 days via MAPI, Base64-encodes it and exfiltrates it to the C2 server. The United States was by a wide margin the most affected country.
On 2018-10-31 Kryptos Logic published analysis of a new Emotet module pushed to existing infections after Emotet had been quiet for about a month. The module is loaded as a DLL from the C2 server and its payload is injected into a new Emotet process. It first checks the registry key HKLM\Software\Clients\Mail\Microsoft Outlook and the DllPathEx value (the path to mapi32.dll); if the key is absent the module does not proceed.
Via Outlook MAPI the module crawls every email in every subfolder under the IPM root folder and collects, for the past 180 days (based on PR_MESSAGE_DELIVERY_TIME), the sender name and address, recipient names and addresses, subject and message body. Bodies longer than 16384 characters are truncated to that size with an ellipsis appended. Results are saved to a temporary file and Base64-encoded. The original module DLL waits up to 300 seconds for the scan process to finish, then sends the file to the C2 over HTTP using the WinINet API if it exceeds 116 bytes.
This builds on an earlier Emotet Outlook-harvesting capability documented by cyber.wtf on 2017-10-12, which iterated over accessible Outlook profiles through MAPI, ranked contacts by frequency, built sender-recipient relationship data, staged it in a temporary file under %PROGRAMDATA% and used a separate module embedding NirSoft Mail PassView to recover mail credentials. The 2018 module extends collection from address relationships to full message content.
The harvested mail content can make follow-on spam more credible (replaying real conversations with a replaced link or attachment) and could support targeted campaigns such as business email compromise, wire fraud or ransomware, per press coverage of the Kryptos Logic findings. Kryptos Logic noted Emotet's prior costly incidents against US state and local governments (up to $1 million per incident per US-CERT). Emsisoft (2018-12-10) reported Emotet's return in early November 2018 after downtime in early October, with phishing lures that ask recipients to enable macros or visit download sites, targeting English and German speakers with significant infections in the U.S., U.K., Turkey and South Africa, and describes Emotet as a dropper for TrickBot and Zeus Panda Banker. The sources do not state a CVE, a version number, specific C2 infrastructure, or named actor attribution. Severity is an analyst judgment.
MITRE ATT&CK techniques used in TL-2026-3835
Discovery
Defense Evasion
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding
Collection
T1074.001 Local Data Staging; T1114.001 Local Email Collection
Execution
Credential Access
T1555 Credentials from Password Stores
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in Emotet Awakens With New Campaign of Mass Email Exfiltration
- Microsoft — Outlook (MAPI-configured profiles on Windows endpoints already infected with Emotet)
Vulnerable versions: Not version-specific; any Outlook with MAPI configured (HKLM\Software\Clients\Mail\Microsoft Outlook present)
Remediation for Emotet Awakens With New Campaign of Mass Email Exfiltration
Immediate actions
- Hunt for the Emotet email-harvesting module by SHA-1 6cd44f2d00b43d80c08922d99d51cce804a59a54
- Alert on non-Outlook processes reading HKLM\Software\Clients\Mail\Microsoft Outlook and loading mapi32.dll
- Isolate hosts with Emotet infections and reset credentials used on those hosts
- Notify contacts whose mail may have been harvested, as it may be reused in follow-on phishing
Workarounds
- Limit Outlook mailbox cache and retained local mail on endpoints where feasible
- Disable macros by Group Policy for documents from the internet
Longer-term hardening
- Block Office macro execution from internet-sourced documents
- Deploy EDR with behavioral detection of process injection and anomalous WinINet uploads
- Train users to report phishing emails that ask them to enable macros
- Restrict outbound HTTP from workstations to approved proxies and inspect POST bodies for large Base64 content
Timeline of Emotet Awakens With New Campaign of Mass Email Exfiltration
- CERT Polska reports a new Emotet variant (April 2017; day approximate), cited by cyber.wtf.
- cyber.wtf publishes analysis of an Emotet module that harvests Outlook contact and sender-recipient relationships via MAPI and stages them in a temp file under %PROGRAMDATA%.
- Emotet goes quiet for roughly a month in early October 2018 (approximate date).
- Virus Bulletin reports that Emotet has started stealing full emails from infected machines.
- Kryptos Logic publishes 'Emotet Awakens With New Campaign of Mass Email Exfiltration'; the United States is the most affected country by a wide margin. Credit given to Tim Davies (@0xtadavie).
- Kryptos Logic observes Emotet pushing a new email-exfiltration module (SHA-1 6cd44f2d00b43d80c08922d99d51cce804a59a54) to infected hosts.
- Emotet phishing campaign resumes in early November 2018 targeting English and German speakers, with significant infections in the U.S., U.K., Turkey and South Africa (per Emsisoft; approximate date).
- PortSwigger Daily Swig and WaterISAC publish coverage of the Emotet resurgence and mass email exfiltration.
- Emsisoft publishes 'Emotet trojan is back with a vengeance', describing macro/download-site lures, TrickBot and Zeus Panda Banker payloads, and the 180-day email harvesting module.
Sources cited for Emotet Awakens With New Campaign of Mass Email Exfiltration
- Emotet Awakens With New Campaign of Mass Email Exfiltration (Kryptos Logic)
- Emotet trojan starts stealing full emails from infected machines (Virus Bulletin)
- High-risk malware program has updated capabilities (PortSwigger Daily Swig)
- Emotet Awakens and Evolves...Again (WaterISAC)
- Emotet trojan is back with a vengeance (Emsisoft)
- Emotet harvests Microsoft Outlook (cyber.wtf)
Detection coverage for TL-2026-3835
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3835 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.