Trickbot Malware Went Into Hiding And Now It’s Back - Olmec Skip to main content

Trickbot Malware Went Into Hiding And Now It’s Back

By August 8, 2020May 5th, 2022Cybersecurity

For more than five months, the internet breathed a collective sigh of relief as one of the most notorious strains of malware, Emotet, went dark and ceased all activity. It was as though the hackers in control of the code had simply pulled the plug. All good things, however, inevitably end. On July 17th, 2020, Emotet came roaring back to life and began spamming out vast numbers of emails in what is apparently a new campaign.

The malware relies on the tried and true tactic of sending emails with poisoned files that are disguised as payment reports, shipping details, employment opportunities, and the like. Of course, that’s just the cover. If an unwitting recipient opens these corrupted files, instead of gaining access to the promised information, they’ll unknowingly install another dreaded malware strain, Trickbot.

Trickbot is a nasty piece of work, capable of spreading laterally throughout a network, compromising an increasing number of machines. On every machine it infects, it will look for and harvest login credentials and cookies from browsers. They pay particular attention to banking credentials, but happily harvest anything else as well.

In addition to that, it will steal OpenSSH keys and Active Directory Services databases and the like. Worst of all, once it has stolen everything it finds of interest, it opens a reverse shell on the network, giving access to groups in control of the Conti and Ryuk ransomware strains. This second group of hackers will gleefully descend on the now fully compromised network, stealing yet more files before encrypting everything and demanding a hefty ransom. It’s a one-two punch that can devastate any business.

Needless to say, this is a true nightmare scenario you don’t want to live through. Be sure your employees and IT staff are on high alert. An Emotet/Trickbot attack is something to be avoided at all cost.

Chris Forte

Chris Forte, President and CEO of Olmec Systems, has been in the MSP workspace for the past 25 years. Chris earned his Master’s Degree from West Virginia University, graduating Magna Cum Laude. He was a past member of the Entrepreneurs’ Organization, a current member of the New Jersey Power Partners and Executive Association of New Jersey, where he has previously served on its board of directors. In his spare time, Chris enjoys traveling with his family. He also admits to being a struggling golfer and avid watcher of college football and basketball. He currently lives in Boonton Township, NJ with his wife, two daughters, son, and black lab Luna.