After a recent hiatus, threat actors from TA542 have once again begun utilizing Emotet malware to distribute thousands of malicious emails to end-users. TA542, also tracked as Mummy Spider, is commonly known for their core development of Emotet malware, which was first observed in 2014. Campaigns launched by TA542 actors typically launch Emotet-driven campaigns that last several months, after which the group will go on a hiatus lasting between three (3) to twelve (12) months. Recently, Emotet activity has once again picked up in early November after going on a four (4) month hiatus following another campaign in July. In this new campaign, Proofpoint analysts noted some significant changes to the Emotet malware including binary changes, improved Excel attachment lure tactics, a light loader called IcedID, and scattering reports of Bumblebee payloads dropped alongside IcedID. In terms of targeting, TA542 has distributed Emotet attacks to users in the United States, United Kingdom, Japan, Mexico, Brazil, and several more. Modifications made by the threat actors appear to correct issues surrounding corrupted hosts within the botnet. CTIX expects this recent campaign to last a few more months before TA542 goes on another hiatus. CTIX continues to monitor threat actor activity throughout the landscape and will provide additional updates accordingly.