{ "id": "1efe5496-b080-45b2-9114-ff410eb1eca5", "created_at": "2026-04-06T01:29:23.219239Z", "updated_at": "2026-04-10T03:23:51.176028Z", "deleted_at": null, "sha1_hash": "b127d2d614de6354f3f1d826d3491675a2875ef8", "title": "Emotet malware now wants you to upgrade Microsoft Word", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1375299, "plain_text": "Emotet malware now wants you to upgrade Microsoft Word\r\nBy Lawrence Abrams\r\nPublished: 2020-10-24 · Archived: 2026-04-06 00:14:21 UTC\r\nEmotet switched to a new template this week that pretends to be a Microsoft Office message stating that Microsoft Word\r\nneeds to be updated to add a new feature.\r\nEmotet is a malware infection that spreads through emails containing Word documents with malicious macros. When\r\nopening these documents, their contents will try to trick the user into enabling macros so that the Emotet malware will be\r\ndownloaded and installed on the computer.\r\nOnce the malware is installed, Emotet will use the computer to send spam emails and ultimately install other malware that\r\ncould lead to a ransomware attack on the victim's network.\r\nhttps://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nNew malicious document template\r\nEmotet spam campaigns use a variety of lures to trick recipients into open an attachment, such as pretending to be invoices,\r\nshipping notices, resumes, or purchase orders, or even COVID-19 information, as shown below.\r\nExample Emotet spam email\r\nAttached to these spam emails are malicious Word (.doc) attachments or links to download one.\r\nWhen opened, these attachments will prompt a user to 'Enable Content' so that malicious macros will run to install the\r\nEmotet malware on a victim's computer.\r\nTo trick users into enabling the macros, Emotet uses various designs, or document templates, that displays a warning to the\r\nuser.\r\nEmotet switched to a new template this week that pretends to be a Microsoft Office message stating that Microsoft Word\r\nneeds to be updated to add a new feature.\r\nUpgrade your edition of Microsoft Word\r\nUpgrading your edition will add new feature to Microsoft Word.\r\nPlease click Enable Editing and then click Enable Content.\r\nTo upgrade Microsoft Word, the document tells the user to click on the Enable Editing and then the Enable Content button,\r\nwhich will cause cause the malicious macros to execute.\r\nhttps://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nPage 3 of 5\n\nNew Upgrade Microsoft Word Emotet attachment\r\nThese malicious macros will download and install the Emotet malware into the victim's %LocalAppData% folder, as shown\r\nbelow.\r\nEmotet malware installed in Windows\r\nWhy it's necessary to recognize Emotet attachments?\r\nEmotet is considered the most widely spread malware targeting users today. It is particularly dangerous as it installs other\r\ninfections such as the Trickbot and QBot malware onto a victim's computer.\r\nWhen installed, TrickBot and QBot will attempt to steal stored passwords, bank information, and assorted other information,\r\nbut also commonly lead to Conti (TrickBot) or ProLock (QBot) ransomware attacks.\r\nDue to this, it is important that all email users recognize malicious document templates used by Emotet so that you do not\r\naccidentally become infected. \r\nhttps://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nhttps://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/emotet-malware-now-wants-you-to-upgrade-microsoft-word/" ], "report_names": [ "emotet-malware-now-wants-you-to-upgrade-microsoft-word" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775438963, "ts_updated_at": 1775791431, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/b127d2d614de6354f3f1d826d3491675a2875ef8.pdf", "text": "https://archive.orkl.eu/b127d2d614de6354f3f1d826d3491675a2875ef8.txt", "img": "https://archive.orkl.eu/b127d2d614de6354f3f1d826d3491675a2875ef8.jpg" } }