2021 will be a challenging year for security professionals. The fall out from the SUNBURST attack and the Solarwinds hack is yet to be fully understood and we all remain in an elevated state of awareness and concern.
Our Threat labs team is constantly looking for new emerging threats by analyzing security events and over 40 million sessions a day on our isolation-powered cloud security company and recently observed the re-emergence of a previously known threat, commonly known as Trickbot.
Trickbot is a prolific malware that has persisted through the times. In 2020 it was greatly responsible for distributing ransomware and was the most popular malware operation that used COVID-19 lures. It was so prolific that in Oct 2020, Microsoft along with its partners obtained a court order to disrupt and take down the infamous Trickbot. It did so by bringing down the infrastructure that was used by the attackers to distribute and send commands to infected endpoints.
In this blog, we are going to detail a campaign that shows how Trickbot might be back and active. In the most recent campaign we observed across our global Menlo Security cloud platform, we noticed the attackers used an interesting lure to get users to click and install the Trickbot malware on the endpoint.
This ongoing campaign that we identified exclusively targeted legal and insurance verticals in North America. The initial vector appears to be an email, which includes a link to a URL. While in the past Trickbot has used weaponized documents, the infection mechanism detailed in this campaign seems to be a new modus operandi used by this group.
Once the user clicks on the initial url in the email, the user is redirected to a compromised server that coaxes the user into downloading a malicious payload. The figure below shows the redirection chain.
The final page that the user lands on, looks like the screenshot below. The attackers are trying to scare the user into downloading a malicious payload, by using the lure of a traffic infringement.
Both the initial URL from which the malware is downloaded and the CnC that it connects to are tagged as Trickbot on URLHaus, which is a popular threat feed.
At the time of writing this blog, some of the URLs identified in this campaign have very little to no detection on VT.
Where there’s a will, there’s a way. That proverb certainly holds true for the bad actors behind trickbot’s operations. While Microsoft and it’s partners' actions were commendable and trickbot activity has come down to a trickle, the threat actors seem to be motivated enough to restore operations and cash in on the current threat environment.