The rise of ransomware has fueled the growth of an ecosystem of criminal actors who specialize in different capabilities needed to pull off successful attacks. Malware delivered by email, such as Emotet, TrickBot and Dridex, are often a precursor to human-operated ransomware attacks.

Since July 17, 2020, Proofpoint researchers have closely tracked the latest series of Emotet campaigns by TA542. During the past 40 days or so of Emotet campaigns, we have seen consistency with past campaigns as well as some notable changes.