Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Trick Bot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

Summary: Unit 42 identified a Trickbot distribution campaign between November 7 and 8, 2019, using phishing emails with payroll and annual bonus subject lines sent from likely-compromised .edu addresses through the legitimate email delivery service SendGrid. The emails linked to a Google Doc containing links to a downloader hosted on Google Drive, which was signed by PERISMOUNT LIMITED, displayed a Microsoft Word icon, and retrieved a Trickbot payload from compromised legitimate domains.

Key Takeaway: The adversaries hid their delivery inside SendGrid, Google Docs and Google Drive, so the initial email and download may not have looked malicious to filters or to the targeted organizations that had legitimate business use for those domains. A search on the string cashcore surfaced over 800 additional Trickbot samples ingested into WildFire between November 4 and 22, 2019, indicating the variant was already in wide use.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026