New Emotet malicious email activity suggest the Emotet Group has restarted activities after taking a few months long hiatus. The detected email activity shows it inserting itself into existing email chains with a malicious unprotected zip attachment, with a financial invoice theme to lure victims. Inside the zip file, there is an Office Word document with macros. Office requests the user to enable content, to which, if accepted, macros run in the background to download and execute the Emotet DLL. It is not known how long this round of email activity will take but from previous rounds, it can be expected to last a few weeks and then disappear for months. Trellix ENS detection: W97M/Downloader.dwu trojan For the current Emotet campaign, Trellix has added a policy rule for the zip attachments that can be enabled on the Email appliances.