Loading story…
Researchers reported that TrickBot evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and rundll32.exe for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity.
The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to Ryuk and later Conti ransomware operations, as well as Anchor-related payload delivery through modules such as mexec. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new TrickBoot module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published a reverse-engineering analysis of the dropper variant of TrickBot's mexec executor module. The report found that the in-memory DLL dropper carried an onboard payload and, in analyzed samples, dropped DNS and normal variants of Anchor TrickBot.
Eclypsium and AdvIntel disclosed that TrickBot had added a module dubbed TrickBoot that probes Intel-based systems for UEFI/BIOS write protections and known firmware weaknesses. The researchers said they had observed reconnaissance activity only, but the module already contained capabilities that could support stealthy persistence or destructive bricking.
Unit 42 published a threat assessment mapping Ryuk ransomware behaviors and ATT&CK techniques to Palo Alto Networks defensive controls and response playbooks. The content focused on mitigation and detection guidance rather than a newly disclosed intrusion event.
Researchers processed a decoded TrickBoot module from permaDll32, also referred to as user_platform_check.dll. The sample showed code to inspect BIOS write protections and included primitives for reading, writing, and erasing SPI flash firmware.
AdvIntel researchers first identified a new TrickBot attack chain in October 2020 that included a firmware-focused module later named TrickBoot. The module expanded TrickBot activity into reconnaissance of UEFI/BIOS protections and weaknesses on targeted systems.
FortiGuard Labs analyzed a TrickBot variant spread through a malicious Microsoft Word document that required users to enable macros. The report described an obfuscated JavaScript loader, sandbox-evasion checks, Startup-folder persistence, and module retrieval from TrickBot command-and-control infrastructure.
Unit 42 published a Wireshark-based tutorial showing how to identify TrickBot infections, including IP-checking, TLS C2 over ports 443/447/449, and HTTP exfiltration over port 8082. The article also described an Active Directory case where TrickBot laterally moved to a domain controller using an EternalBlue-based SMB exploit.
Between November 7 and November 8, 2019, attackers ran a TrickBot phishing campaign using payroll-themed lures sent through SendGrid and redirected victims through Google Docs and Google Drive. The downloader executables fetched TrickBot payloads from compromised legitimate websites and established persistence with a scheduled task named System cache service.
Unit 42 reported that WildFire ingested more than 800 additional samples associated with the same cashcore-based TrickBot variant between November 4 and November 22, 2019. The finding indicated broader active use of the campaign beyond the initially observed phishing samples.
In a September 2019 example, a malicious spam campaign delivered a ZIP archive containing InvoiceAndStatement.lnk, which downloaded a TrickBot executable. Unit 42 used this infection chain to illustrate recognizable TrickBot network traffic in packet captures.
Fortinet published a deep analysis of TrickBot after examining a malicious Word document named InternalFax.doc that downloaded the banking trojan. The report detailed TrickBot's modular architecture, scheduled-task persistence, browser injection, command-and-control workflow, and banking-targeting activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourceeclypsium.com
Open sourceunit42.paloaltonetworks.com
Open sourcefortinet.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.fortinet.com
Open sourceadvanced-intel.com
Open sourceadvintel.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into `%AppData%\Roaming`, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an **XMRig** Monero miner alongside its core modules. Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports `443`, `447`, and `449`, HTTP exfiltration on port `8082`, and disguised payload retrieval through `.png` URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for **Cobalt Strike** and ransomware including **Ryuk** and **Conti**. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver **Emotet** and **Qbot**, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Aug 15, 2026
Researchers and government agencies reported that **TrickBot** continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including **Ryuk** and **Conti** ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected `.docm` files used an `AutoOpen` macro to extract hidden VBScript, write a `.VBE` file to `C:\ProgramData`, rebuild a TrickBot DLL, decode it with `certutil`, and execute it through `regsvr32.exe`, helping the malware evade static and behavioral detection. TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older **`mworm`** propagation module with **`nworm`**, which fetched an encrypted payload over HTTP and executed it **in memory** on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with **MikroTik** routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific **gtag** identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of **`CVE-2017-0144`**, and phishing-driven execution chains that lead to TrickBot installation.
Aug 15, 2026
U.S. Cyber Command and Microsoft led parallel efforts to disrupt the **TrickBot** botnet, a major criminal infrastructure used to distribute ransomware and viewed as a potential threat to U.S. election security. Microsoft said it disabled **120 of 128** identified servers through court orders and coordination with hosting providers, ISPs, and international partners, while U.S. officials described a separate military operation intended to temporarily knock the botnet off balance and force its operators to spend time rebuilding rather than launching attacks. Earlier reporting had already shown TrickBot expanding beyond banking malware into large-scale email abuse through its **TrickBooster** module, which harvested credentials and contacts, sent spam from compromised accounts, and was tied to a database containing roughly **250 million** harvested email addresses. The disruption did not eliminate the threat. Incident responders documented a late-2020 intrusion in which TrickBot operators manually deployed malware, used **Cobalt Strike** for privilege escalation and lateral movement, dumped `LSASS` and `NTDS.dit`, and conducted extensive Active Directory reconnaissance consistent with a likely **Ryuk** ransomware attack path. By the end of 2021, reporting indicated that the **Conti** ransomware group had absorbed key TrickBot personnel and become the botnet’s primary user, with plans to shift initial access operations toward **BazarBackdoor**. The FBI also linked **Diavol** ransomware to the TrickBot group, underscoring how the operation persisted after takedowns and continued to serve as a core access and development hub for multiple ransomware campaigns.
Aug 15, 2026