The infamous “Emotet” malware has begun reappearing after the takeover of its infrastructure by international law enforcement in late January of this year. Research groups Cryptolaemus, GData, and Advanced Intel have identified “TrickBot malware dropping a loader for Emotet on infected devices”. Previously, Emotet installed the TrickBot malware, but Cryptolaemus researchers identified the utilization of the “Operation Reacharound” method, which “rebuilds the botnet using TrickBot’s existing infrastructure”. The researchers also confirmed that the malware has a different command buffer, now being seven (7) rather than three (3) to four (4) in the past, and appears to be “various execution options for downloaded binaries (since it’s not just dlls [dynamic link libraries]”. GData released a posting regarding their current analysis of the Emotet malware and stated, “we have high confidence that the samples indeed seem to be a re-incarnation of the infamous Emotet”. The current indicators of compromise (IOCs) can be viewed at the conclusion of their posting, but investigations into the resurfacing of Emotet are ongoing.