TrickBot is malware associated with cyber incidents, with reporting on its analysis, infrastructure, disruption efforts, and defensive guidance.
Search across headline titles and summaries.
Background for this topic.
TrickBot is a modular Windows malware family first identified as a banking Trojan in 2016. Its modules have supported theft of credentials and other sensitive information, system discovery, and remote control. In documented campaigns, operators also used TrickBot as an access and payload-delivery component, including before ransomware activity; those associations do not mean every TrickBot infection leads to ransomware.
Reporting commonly covers TrickBot’s modules, command-and-control infrastructure, changing delivery mechanisms, and efforts to disrupt its operations. For defenders, an alert should prompt investigation beyond the initially infected host: isolate it, examine authentication and endpoint telemetry for credential theft or lateral activity, and reset exposed credentials from a trusted system. Keeping operating systems and internet-facing software patched, restricting administrative access, and monitoring unusual outbound connections can reduce the opportunity for follow-on activity. Threat-intelligence indicators are useful for detection, but should be combined with behavioral evidence because the malware and its infrastructure have changed over time.
Latest campaigns are a break from its usual financially motivated attacks and appear aligned with Russian interests, security researchers say.
In what's being described as an "unprecedented" twist, the operators of the TrickBot malware have resorted to systematically targeting Ukraine since the onset of the war in late February 2022