A minimal Emotet campaign was recently unleashed with newly observed tactics and techniques, specifically the incorporation of OneDrive and XLL files into the botnet. The threat actors tied to this Emotet activity are TA542, a threat organization who commonly deploys Emotet in its campaigns and has closely maintained control of the botnet since 2014. TA542 primarily targets entities throughout the Americas, Europe, Asia, and Australia with common attack vectors of credential harvesting, phishing campaigns, and social engineering techniques. This new Emotet campaign was deployed between April 4, 2022, and April 19, 2022, and had characteristics that differentiate it from other campaigns tied to this botnet. Typically, when an Emotet campaign is deployed, a massive number of messages are sent out to thousands of victims; however, in this case, there was a significantly smaller number of messages distributed. In addition, this campaign utilized OneDrive URLs rather than the more common malware-laced Office documents. Furthermore, rather than macro-malware documents, this campaign was observed using XLL files that allow for additional functionality for the Microsoft Excel platform. With such a low level of activity from this campaign, security researchers indicate this was a campaign to test out new capabilities of Emotet and will likely be followed by a much larger campaign in the coming months. CTIX will continue to monitor the botnet and threat organization and provide additional updates accordingly