Report: U.S. Cyber Command Behind Trickbot Tricks
Summary: A Washington Post report citing four anonymous U.S. officials says U.S. Cyber Command carried out the October 2020 operation that sent Trickbot-infected systems a command to disconnect from their control servers and stuffed the botnet's database with millions of bogus victim records. Hold Security's Alex Holden said the operators still hold passwords and financial data stolen from more than 2.7 million systems, have begun rebuilding the botnet, and are discussing raising future ransom demands from roughly 10 percent of a victim's annual revenue to 100 or 150 percent.
What you should know: The disruption was described by officials as a distraction rather than a takedown, and the operators' stolen data from 2.7 million systems is intact - so the same crew is back to deploying ransomware and talking about demanding a victim's full annual revenue.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026