The Emotet trojan is active again and I read a bit about how it propagates. This includes phishing and having users launch all kind of files (exes, fiels with macros, ...) - a typical method.
It also scans the network for writable shares (where it can copy itself) and tries to brute force accounts.
Since it does not seem to use vulnerabilities to activate the remote copy (*), how does it activates itself in a massive way?
(*) an answer to a similar question suggests this as a vector, but see How does Emotet spread? in the first linked article
