TrickBot Malware

What Is TrickBot?

As a malware employing nearly every hacking trick in the book, TrickBot lives up to its name and is a top threat, according to the Cybersecurity Infrastructure and Security Agency (CISA). TrickBot emerged in 2016 as a sophisticated banking Trojan written in C++ targeting Windows-based systems. Its rise has been attributed to an infamous group of Russian cybercrime actors known as WizardSpider with suspected ties to the Russian government.

TrickBot has evolved into a modular malware architecture capable of attacks that place it in multiple categories, including initial access trojan, stealer/spyware, remote access trojan (RAT), and ransomware. TrickBot includes a robust set of second-stage post-infection capabilities for network penetration that allow it to move laterally stealthily through even well-defended corporate networks.

Due to its expansive arsenal of capabilities, TrickBot functions as a Swiss-Army-knife-like weapon in cyberattacks against large corporations, government agencies, and healthcare facilities; it is the command and control (C2) malware of choice for deploying Ryuk and Conti ransomware. However, TrickBot has also been used to compromise the home routers of everyday consumers, allowing threat actor groups to build global botnets. TrickBot's diverse and sophisticated capabilities are unmatched by any other malware.

How TrickBot Works

TrickBot is typically delivered via first-stage downloader malware employing social engineering tactics such as spear-phishing and drive-by-downloads—enticing victims with pirated copies of popular software—to gain initial access to a system. TrickBot's first-stage malware often executes a heavily obfuscated JavaScript file that completes the infection by connecting to an attacker-controlled C2 server, downloading the primary TrickBot payload, and executing it. 

TrickBot can infect internet browsers to passively surveil user activity and steal session cookies, usernames and passwords, and browsing history. TrickBot also has built-in tools for network enumeration and host discovery, privilege escalation, authentication brute force, man-in-the-middle reconnaissance, proxying, data tampering, lateral movement, persistence, and ransomware deployment. During its operations, TrickBot strategically swaps C2 servers and keeps a cache of active C2 IP addresses in case one gets taken down or blocklisted. 

TrickBot's stealth tactics include using HTTP encrypted connections via SSL/TLS to mask its C2 activity as regular web traffic and employing fileless malware techniques, operating only in-memory (memexec) to avoid being discovered by security products. To prevent security researchers from easily analyzing its source code, TrickBot uses multi-stage encryption-based obfuscation.

Signs of a TrickBot Attack

End users will not notice any obvious signs of a TrickBot infection unless it has already deployed ransomware to render files unreadable. However, monitoring network activity will reveal outgoing requests to blocklisted IPs and domains as TrickBot attempts to connect to its C2 servers or redirect internet users to malicious websites. 

Because TrickBot's techniques are advanced and constantly evolving, the most reliable way to detect an attack is to install and correctly configure advanced security tools such as Endpoint Detection and Response (EDR)Extended Detection and Response (XDR), and Network Intrusion Detection and Prevention (NIDS/NIPS) products. 

How to Prevent a TrickBot Attack

Effectively preventing a TrickBot cyberattack requires a complete enterprise cybersecurity program, including a full scope of policies, controls, procedures, and user awareness training to cover all aspects of an organization's cybersecurity. Below is a short list of defensive measures that can reduce the chances of a TrickBot compromise. 

  • Implement modern Identity and Access Management (IAM) tools
  • Install and configure advanced endpoint security products on all endpoints to detect indicators of compromise (IOCs) and take defensive action to block TrickBot payloads from executing
  • Ensure that only authorized, digitally signed software is installed on all endpoints; regularly scan for and block any unauthorized software from executing
  • Conduct regular vulnerability scanning and penetration testing of all network infrastructure; remediate any discovered vulnerabilities as soon as possible
  • Use a content proxy to monitor internet usage and restrict users from accessing suspicious or risky sites
  • Enforce multi-factor authentication for all critical services
  • Consider user awareness training to educate personnel about phishing techniques and develop standard operating procedures (SOP) for handling suspicious emails and documents
  • Configure email clients to notify users when emails originate from outside the organization
  • Ensure Office applications are configured with Disable all macros without notification or Disable all except digitally signed macros settings
  • Pay special attention to warning notifications in email clients and Office applications that can alert you to suspicious contexts, such as files that have not been scanned for malware or contain VBA macros
As a human-centric subscription-based 24x7x365 Managed XDR service, CylanceGUARD® provides the expertise and support businesses need to prevent and protect against ransomware attacks. CylanceGUARD combines the comprehensive expertise embodied by BlackBerry Cybersecurity Services with AI-based Endpoint Protection (EPP) through CylancePROTECT®, continuous authentication and analytics through CylancePERSONA, and on-device threat detection and remediation through CylanceOPTICS®. In short, CylanceGUARD provides business with the people and technology needed to protect the enterprise from the modern threat landscape.