Intel471 said in a blog post that it had observed the Trickbot banking trojan downloading and executing possible updated Emotet binaries.

In the last week of January, a statement from Europol said a collective disruption of the botnet had put it out of whack.

"To severely disrupt the Emotet infrastructure, law enforcement teamed up together to create an effective operational strategy," the police force said.

But just a day after this announcement, a veteran security researcher warned that the botnet could well return since the primary operators had not been apprehended.

Chester Wisniewski, principal research scientist at global cyber security firm Sophos, said: "The world will certainly be a safer place with Emotet temporarily neutralised, but that is just part of the issue so far.

"It appears that the primary Emotet operators were not apprehended. This allows them to rebuild new infrastructure and go back to business as usual. Considering the massive profits associated with their activity, they might also simply choose to retire while ahead. Only time will tell."

Intel471 said it had observed some differences between the old Emotet and the new version. "...differences we've discovered so far between this new Emotet sample and the older version are mostly around the communication protocol. New Emotet uses elliptic-curve cryptography where the older Emotet favoured RSA," the company said.

"We said back in January that 'time will tell if the takedown will have a long-term impact on Emotet operations. The groups who run these botnets are sophisticated and resilient, and will most likely have some sort of inherent recovery in place'.

"While that recovery took months, the resiliency displayed here shows that the cat-and-mouse game with Emotet’s developers will continue into 2022. We can’t definitively say if Emotet is back for real or if this is some sort of test, but this shows that the actors that control Emotet’s source code are not done with it yet."