Why do threat actors keep using email to deliver commodity malware even after major disruptions?

Why This Matters for Security Teams

Email remains a durable delivery channel because it sits inside normal business workflows, crosses organisational boundaries, and can be tuned for volume or precision depending on the campaign. For defenders, the important point is not that a single malware family survives, but that the same delivery logic keeps working across replacements. That makes mailbox controls, attachment handling, and URL inspection part of resilience, not just hygiene. Guidance from CISA cyber threat advisories consistently shows that commodity malware activity often reappears through familiar initial access patterns even after public disruption.

Security teams often misread these campaigns as isolated phishing events when they are usually part of a broader intrusion chain. The real risk is the handoff from lure to execution: a user clicks, a script runs, a payload is fetched, and defensive focus arrives too late if it is fixed only on the final malware name. That is why message traceability, sandboxing, and detections for script-based child processes matter as much as blocklists.

In practice, many security teams encounter the same delivery pattern only after one user has already enabled the chain, rather than through intentional prevention.

How It Works in Practice

Commodity malware operators prefer email because it gives them cheap reach, fast iteration, and plenty of room to test lures. Even after a botnet takedown or a loader disruption, the actors rarely need to invent a new channel. They change subject lines, sender infrastructure, landing pages, or payload hosting, then reuse the same path from message to execution. This is why defenders should monitor the full behaviour chain rather than only known hashes or one malware family name.

Operationally, the chain often looks like this: a message contains a link, attachment, or embedded document; the user opens it; a script or macro stage retrieves the next component; then the payload executes with whatever permissions the endpoint grants. Current guidance from CIS Controls v8 and NIST SP 800-53 Rev 5 Security and Privacy Controls supports layered mailbox filtering, executable content restrictions, logging, and response workflows that can interrupt this chain at multiple points.

• Filter and detonate suspicious URLs and attachments before delivery to the inbox.
• Block or alert on script interpreters, spawned shells, and unusual child processes from Office or browser contexts.
• Correlate email telemetry with endpoint events so analysts can see the full sequence from message receipt to execution.
• Use IOC blocking for short-lived infrastructure, but pair it with behavioural detections because infrastructure changes quickly.

Where email delivery intersects with AI-assisted phishing, the same problem becomes harder because content generation and targeting can scale quickly. Emerging reporting such as the Anthropic — first AI-orchestrated cyber espionage campaign report and the MITRE ATLAS adversarial AI threat matrix shows that automation can improve lure quality, but it does not change the underlying need for staged execution and network retrieval. These controls tend to break down in highly permissive environments where users can run scripts, bypass browser protections, and download payloads directly from external storage without inspection.

Common Variations and Edge Cases

Tighter email and endpoint controls often increase user friction and security operations overhead, so organisations must balance faster interruption against the risk of disrupting legitimate workflows. The basic advice stays the same, but the implementation changes across environments. In some businesses, script blocking is straightforward; in others, it collides with finance macros, legacy line-of-business tools, or approved automation.

Best practice is evolving for environments that rely on cloud mail, SaaS collaboration, and outsourced helpdesk workflows. For example, a campaign may begin in email but complete through a shared document, chat invite, or cloud storage link. That is why threat hunters should treat the inbox as one hop in the intrusion chain, not the whole story. Where identity is part of the delivery path, stolen sessions and abused accounts can make the message look legitimate even when the payload is malicious.

Edge cases also matter when defenders try to overfit detections to one family. A takedown can remove a loader, but if the organisation only blocks that filename, the next campaign will still succeed through a renamed archive, a different script host, or a fresh download domain. The practical answer is behaviour-based control coverage, supported by ENISA Threat Landscape style monitoring for trends rather than single indicators.

Current guidance suggests there is no universal standard for fully eliminating email as an initial access vector, only for shrinking its success rate and shortening dwell time.

Related resources from NHI Mgmt Group

• Why do many enterprises keep SAML even after adopting OIDC?
• Why do unused SaaS licences keep creating cost even when teams stop using the app?
• Why do AI systems keep reproducing unfair outcomes even after retraining?
• Why do organisations keep Active Directory even after moving heavily to the cloud?