: April 2022 was a peak period for Emotet before its subsequent infrastructure takeovers and shifts.

Both firms published blogs in early 2022 regarding the resurgence of . Unit 42 : Look for their research on Emotet's evolution .

: The password was usually provided in the email body, making the user feel "secure" while actually helping the malware bypass the gateway.

Around April 2022, security researchers tracked a significant spike in malicious emails using password-protected .7z archives. : Often delivered the Emotet Trojan.

: They explain why the hackers used the .7z format (it has a higher compression ratio and was less scrutinized by legacy scanners). 💡 Why this file is "Interesting"

: It marked a shift where attackers used password-protected archives to hide the payload from automated sandbox analysis.