# Emotet Awakens With New Campaign of Mass Email Exfiltration

> Kryptos Logic reported that Emotet, after roughly a month of dormancy, began delivering a new module that harvests sender, recipient, subject and body of Outlook email from the past 180 days via MAPI, Base64-encodes it and exfiltrates it to the C2 server. The United States was by a wide margin the most affected country.

- **Published:** 2026-10-17T20:01:48Z
- **Last reviewed:** 2026-10-17T20:01:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3835
- **ID:** TL-2026-3835
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2018-10-31 Kryptos Logic published analysis of a new Emotet module pushed to existing infections after Emotet had been quiet for about a month. The module is loaded as a DLL from the C2 server and its payload is injected into a new Emotet process. It first checks the registry key HKLM\Software\Clients\Mail\Microsoft Outlook and the DllPathEx value (the path to mapi32.dll); if the key is absent the module does not proceed.

Via Outlook MAPI the module crawls every email in every subfolder under the IPM root folder and collects, for the past 180 days (based on PR_MESSAGE_DELIVERY_TIME), the sender name and address, recipient names and addresses, subject and message body. Bodies longer than 16384 characters are truncated to that size with an ellipsis appended. Results are saved to a temporary file and Base64-encoded. The original module DLL waits up to 300 seconds for the scan process to finish, then sends the file to the C2 over HTTP using the WinINet API if it exceeds 116 bytes.

This builds on an earlier Emotet Outlook-harvesting capability documented by cyber.wtf on 2017-10-12, which iterated over accessible Outlook profiles through MAPI, ranked contacts by frequency, built sender-recipient relationship data, staged it in a temporary file under %PROGRAMDATA% and used a separate module embedding NirSoft Mail PassView to recover mail credentials. The 2018 module extends collection from address relationships to full message content.

The harvested mail content can make follow-on spam more credible (replaying real conversations with a replaced link or attachment) and could support targeted campaigns such as business email compromise, wire fraud or ransomware, per press coverage of the Kryptos Logic findings. Kryptos Logic noted Emotet's prior costly incidents against US state and local governments (up to $1 million per incident per US-CERT). Emsisoft (2018-12-10) reported Emotet's return in early November 2018 after downtime in early October, with phishing lures that ask recipients to enable macros or visit download sites, targeting English and German speakers with significant infections in the U.S., U.K., Turkey and South Africa, and describes Emotet as a dropper for TrickBot and Zeus Panda Banker. The sources do not state a CVE, a version number, specific C2 infrastructure, or named actor attribution. Severity is an analyst judgment.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1055 Process Injection
- T1012 Query Registry
- T1555 Credentials from Password Stores
- T1114.001 Local Email Collection
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1132.001 Standard Encoding

## Sources

- [Emotet Awakens With New Campaign of Mass Email Exfiltration (Kryptos Logic)](https://www.kryptoslogic.com/blog/2018/10/emotet-awakens-with-new-campaign-of-mass-email-exfiltration/)
- [Emotet trojan starts stealing full emails from infected machines (Virus Bulletin)](https://www.virusbulletin.com/blog/2018/10/emotet-trojan-starts-stealing-full-emails-infected-machines/)
- [High-risk malware program has updated capabilities (PortSwigger Daily Swig)](https://portswigger.net/daily-swig/emotet-resurgence-includes-mass-email-exfiltration)
- [Emotet Awakens and Evolves...Again (WaterISAC)](https://www.waterisac.org/?p=13647)
- [Emotet trojan is back with a vengeance (Emsisoft)](https://www.emsisoft.com/en/blog/32439/emotet-trojan-is-back-with-a-vengeance/)
- [Emotet harvests Microsoft Outlook (cyber.wtf)](https://cyber.wtf/2017/10/12/emotet-beutet-outlook-aus/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3835