Loading story…
Researchers and government agencies reported that TrickBot continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including Ryuk and Conti ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected .docm files used an AutoOpen macro to extract hidden VBScript, write a .VBE file to C:\ProgramData, rebuild a TrickBot DLL, decode it with certutil, and execute it through regsvr32.exe, helping the malware evade static and behavioral detection.
TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older mworm propagation module with nworm, which fetched an encrypted payload over HTTP and executed it in memory on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with MikroTik routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific gtag identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of CVE-2017-0144, and phishing-driven execution chains that lead to TrickBot installation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
HP Wolf Security says a stealthy TrickBot malspam campaign began on 16 September 2020, using COVID-19 alert and invoice lures with encrypted DOCM attachments tagged with gtag "ono76."
Unit 42 lists propagation URLs including /ico/VidT6cErs for nworm and /images/cursor.png and /images/imgpaper.png for mshare and tab, all first seen on 2020-04-20.
In April 2020, Unit 42 observed TrickBot stop using the mworm module in lab infections and replace it with a new propagation module called nworm, which fetched encrypted or encoded payloads and executed them in memory on domain controllers.
Unit 42 says that since February 2020, propagation-related URLs used IP addresses rather than domains, with distinct path patterns for mshare, mworm, and tab payload retrieval.
Unit 42 reports that starting in September 2019, TrickBot propagation to vulnerable Active Directory domain controllers used the mworm, mshare, and tab modules.
HP Wolf Security says that since June 2019, TrickBot has also been used to distribute post-exploitation tools and Ryuk ransomware, especially against large enterprises.
HP Wolf Security states TrickBot was first seen in 2014, while later CISA and Splunk references describe it as first identified or active since 2016 as a banking Trojan and crimeware platform.
CISA and the FBI issued a Joint Cybersecurity Advisory stating that TrickBot continued targeting victims in North America through spearphishing campaigns using traffic-infringement lures and malicious JavaScript downloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
splunk.com
Open sourceus-cert.cisa.gov
Open sourcethreatresearch.ext.hp.com
Open sourceen.wikipedia.org
Open sourceunit42.paloaltonetworks.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into `%AppData%\Roaming`, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an **XMRig** Monero miner alongside its core modules. Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports `443`, `447`, and `449`, HTTP exfiltration on port `8082`, and disguised payload retrieval through `.png` URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for **Cobalt Strike** and ransomware including **Ryuk** and **Conti**. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver **Emotet** and **Qbot**, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Aug 15, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
U.S. Cyber Command and Microsoft led parallel efforts to disrupt the **TrickBot** botnet, a major criminal infrastructure used to distribute ransomware and viewed as a potential threat to U.S. election security. Microsoft said it disabled **120 of 128** identified servers through court orders and coordination with hosting providers, ISPs, and international partners, while U.S. officials described a separate military operation intended to temporarily knock the botnet off balance and force its operators to spend time rebuilding rather than launching attacks. Earlier reporting had already shown TrickBot expanding beyond banking malware into large-scale email abuse through its **TrickBooster** module, which harvested credentials and contacts, sent spam from compromised accounts, and was tied to a database containing roughly **250 million** harvested email addresses. The disruption did not eliminate the threat. Incident responders documented a late-2020 intrusion in which TrickBot operators manually deployed malware, used **Cobalt Strike** for privilege escalation and lateral movement, dumped `LSASS` and `NTDS.dit`, and conducted extensive Active Directory reconnaissance consistent with a likely **Ryuk** ransomware attack path. By the end of 2021, reporting indicated that the **Conti** ransomware group had absorbed key TrickBot personnel and become the botnet’s primary user, with plans to shift initial access operations toward **BazarBackdoor**. The FBI also linked **Diavol** ransomware to the TrickBot group, underscoring how the operation persisted after takedowns and continued to serve as a core access and development hub for multiple ransomware campaigns.
Aug 15, 2026