Just in time for the Christmas holiday, Emotet is sending the gift of Trickbot.

After a lull of nearly two months, the Emotet botnet has returned with updated payloads and a campaign that is hitting 100, 000 targets per day.

Emotet started life as a banking trojan in 2014 and has continually evolved to become a full-service threat-delivery mechanism. It can install a collection of malware on victim machines, including information stealers, email harvesters, self-propagation mechanisms and ransomware. It was last seen in volume in October, targeting volunteers for the Democratic National Committee (DNC); and before that, it became active in July after a five-month hiatus, dropping the Trickbot trojan. Before that, in February, it was seen in a campaign that sent SMS messages purporting to be from victims’ banks.