Trickbot: A primer
Summary: Trickbot, first discovered in 2016 as a successor to the Dyre trojan, has evolved into a modular banking trojan that steals browser cookies and performs webinjects on banking and cryptocurrency sites, and is commonly used as a dropper for Ryuk ransomware. It is typically delivered through spam emails with alarming subject lines, including COVID-19 themes, whose malicious documents run macros to download the next stage, sometimes a loader like Emotet that in turn drops Trickbot.
Bottom line: The Trickbot Gang also rents a Trickbot variant to state-sponsored APT groups and sells access it has gained to high-profile networks, and the Emotet-Trickbot-Ryuk chain generated millions of dollars in income in 2019 alone.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026