TrickBot is malware associated with cyber incidents, with reporting on its analysis, infrastructure, disruption efforts, and defensive guidance.
Search across headline titles and summaries.
Background for this topic.
TrickBot is a modular Windows malware family first identified as a banking Trojan in 2016. Its modules have supported theft of credentials and other sensitive information, system discovery, and remote control. In documented campaigns, operators also used TrickBot as an access and payload-delivery component, including before ransomware activity; those associations do not mean every TrickBot infection leads to ransomware.
Reporting commonly covers TrickBot’s modules, command-and-control infrastructure, changing delivery mechanisms, and efforts to disrupt its operations. For defenders, an alert should prompt investigation beyond the initially infected host: isolate it, examine authentication and endpoint telemetry for credential theft or lateral activity, and reset exposed credentials from a trusted system. Keeping operating systems and internet-facing software patched, restricting administrative access, and monitoring unusual outbound connections can reduce the opportunity for follow-on activity. Threat-intelligence indicators are useful for detection, but should be combined with behavioral evidence because the malware and its infrastructure have changed over time.
A Russian national has been found guilty in connection with his role in developing and deploying a malware known as TrickBot, the U.S. Department of Justice (DoJ) announced
Vladimir Dunaev Faces Up to 35 Years in PrisonA Russian national pleaded guilty in U.S. federal court for his role in developing TrickBot. Operators of the malware targeted hospitals and healthcare centers with ransomware attacks during the height of the novel coronavirus pandemic. Vladimir Dunaev faces up to 35 years in prison.
On Thursday, a Russian national pleaded guilty to charges related to his involvement in developing and deploying the Trickbot malware, which was used in attacks against hospitals, companies, and individuals in the United States and worldwide. [...]
Hunt continues for the other elusive high-ranking members Another member of the Trickbot malware crew now faces a lengthy prison sentence amid US law enforcement's ongoing search for its leading members.…