Attacks Aimed at Disrupting the Trickbot Botnet
Summary: Over 10 days beginning Sept. 22, someone pushed bogus configuration files to Trickbot-infected Windows PCs pointing them at 127.0.0.1, a localhost address not reachable over the public Internet, and repeated the update on Oct. 1, after which Intel 471 reported that all Trickbot controllers stopped responding correctly to bot requests. Around the second update, someone also flooded Trickbot's control networks with millions of fake records, growing its holdings from more than 2.7 million Windows PCs at the end of September to more than seven million by Oct. 1, according to Hold Security.
Key Takeaway: Trickbot is the entry point for Ryuk and Conti ransomware, and the same week this disruption campaign ran, Universal Health Services shut down systems at more than 400 facilities and hospitals redirected ambulances and relocated surgery patients.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026