Loader / botnetATT&CK S0266
TrickBot
Also known as: Totbrick, TSPY_TRICKLOAD
TrickBot started as a banking trojan and became a modular platform for credential theft, network reconnaissance and delivering ransomware such as Ryuk and Conti. CISA's 2021 advisory described its spread through phishing and its use as an entry point for ransomware operators.
- Public attribution and associated actors
- MITRE ATT&CK lists TrickBot as used by Wizard Spider and TA505. In 2023 the US and UK sanctioned members of what they described as the Russia-based Trickbot cybercrime gang.As publicly reported:Wizard SpiderTA505
- First seen
- Around 2016
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0266 TrickBot
Status: The US and UK sanctioned members of the Trickbot group in February 2023 (US Treasury).
How it spreads or gets in
- Phishing emails with malicious attachments or links, and installation by other malware such as Emotet.
- Lateral movement by exploiting SMB and with stolen credentials.
Key behaviours
- Stole browser credentials and injected into banking sessions.
- Mapped Active Directory trusts to plan ransomware deployment.
- Included a module able to inspect and modify device firmware.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1055.012Process Injection: Process Hollowing
- T1185Browser Session Hijacking
- T1555.003Credentials from Password Stores: Credentials from Web Browsers
- T1482Domain Trust Discovery
- T1210Exploitation of Remote Services
- T1542.003Pre-OS Boot: Bootkit
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on domain trust enumeration from ordinary workstations.
- Detect process hollowing of legitimate system binaries.
- Hunt for scheduled tasks created in user profiles with random names.
Defences that work
- Block macros from the internet and sandbox attachments.
- Remove local admin rights from users.
- Treat TrickBot infections as ransomware precursors and contain them fast.