TrickBot fik et nyt modul til overvågning af ofre
Ifølge Kontrolpunkt, TrickBot remains one of the most active threats in the world, even acquiring new module for tracking victims. It also seems that TrickBot takes precedence in the ranking of the most active malware for the second month in a row.
After the Emotet botnet was destroyed by law enforcement agencies, TrickBot activity continues to grow.
Så, i juni 2021, TrickBot attacked about 7% of companies around the world, and researchers remind that ransomware groups (for eksempel, Ryuk and REvil) use different malware at the initial stages of infection, but the main one is still TrickBot.
Let me remind you that TrickBot is one of the largest and most successful malwares today. Malware blev først opdaget igen 2015, shortly after a series of high-profile arrests that significantly changed the composition of the Dyre hack group.
I årenes løb, malware har udviklet sig fra en klassisk banktrojaner designet til at stjæle penge fra bankkonti til en multifunktionel dropper, der spreder andre trusler (fra minearbejdere til ransomware og info-tyvere). For eksempel, TrickBot is used by such well-known ransomware as Ryuk, Conti and REvil.
I efteråret 2020, a large-scale operation was carried out aimed at eliminating TrickBot. Det blev overværet af retshåndhævende myndigheder, specialister fra Microsoft Defender-teamet, non-profit organisationen FS-ISAC, samt ESET, Lumen, NTT og Symantec. På det tidspunkt, many experts wrote that although Microsoft was could disable the TrickBot infrastructure, højst sandsynligt vil botnettet “overleve” og til sidst vil dets operatører sætte nye kontrolservere i drift og fortsætte deres aktivitet. uheldigvis, this is what happened.
Bitdefender experts skrive that the malware developers have recently updated the VNC module (vncDLL), which is used after attacks on particularly important targets. The updated module is called tvncDLL and allows attackers to spy on their victim, collecting information that will allow the attack to be transferred to the most important systems on the victim’s network.
The tvncDLL module was spotted back in mid-May this year, but it is still under development, and the hack group has an “update schedule that regularly adds new features and fixes bugs.”
Analysis of the module shows that it uses a custom communication protocol and communicates with the control server through one of nine proxy IP addresses, which provides access to victims behind firewalls.
The VNC module can stop TrickBot from running and even unload malware from memory. When the malware operator initiates communication, the module creates a virtual desktop with a custom interface.
Using the command line, malware operators can download fresh payloads from their C&C server, open documents and mail, and steal other data from a compromised system.
Another option, called Native Browser, generally launches the browser using OLE automation in Internet Explorer. This feature is under development and is designed to steal passwords from Google Chrome, Mozilla Firefox, Opera and Internet Explorer.
Lad mig minde dig om, at jeg også skrev det Forskere forbandt TrickBot-udviklere med Diavol ransomware.
