Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Goodbye Mworm, Hello Nworm: Trick Bot Updates Propagation Module

Summary: TrickBot, an information stealer first discovered in 2016 that provides backdoor access, replaced its "mworm" propagation module with a new "nworm" module as early as April 2020, according to Unit 42 lab observations. Unlike mworm, nworm runs from memory on an infected Domain Controller, leaves no artifacts, does not survive a reboot or shutdown, and retrieves its TrickBot binary encrypted or encoded over the Internet.

Key Takeaway: The module that leaves no artifacts and vanishes on reboot is aimed squarely at Domain Controllers, the servers that rarely get restarted, so the usual persistence-based detection has nothing to find. TrickBot's developers made this change explicitly to avoid detection, and the module only appears when the infection reaches an Active Directory environment with a DC.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related