VERY IMPORTANT

On April 26, 2022, a new Emotet campaign was spotted in the wild, where the usual Office delivery system was replaced with LNK files, in a clear response to the VBA protection launched by Microsoft. Researchers found 139 distinct LNK files that are part of the same campaign, delivering two distinct payloads that share the same C2 infrastructure.