Collaborate Disseminate
We have had just over a one week break from Trickbot being distributed via Malspam and Spear phishing style emails. But it is a new month and the Trickbot gang have their quotas to meet, so they are back with their usual malspam campaigns. They conti… Continue reading trickbot still being delivered by fake payroll emails
Trickbot are continuing with their malware spreading campaigns using Office Macros, particularly Excel spreadsheets with macros. Today’s example is an email pretending to be an invoice for nearly £35,000 containing the subject of “FW: Inv… Continue reading Trickbot delivered via fake Intuit “FW: Invoice #3989021 ” email
The criminals behind the Trickbot banking trojan are continuing to use Deloitte as a lure. Somebody at Deloitte must have really annoyed them, because it is very unusual for the same company to be targeted and used as the lure several days in a row, … Continue reading Yet another fake Deloitte email “RE: Company records ” delivers Trickbot
The second of Today’s Trickbot campaigns is a US targeted version this evening. Yesterday they also used Deloitte as the lure. This example is an email containing the subject of “FW: Financial Statements ” pretending to come from De… Continue reading Another Fake Deloitte email “FW: Financial Statements” delivers Trickbot
After a short break for about 1 week, we are seeing Trickbot hitting the UK again this morning with its usual massive malspam campaign. This example is an email containing the subject of “Company tax credits ” pretending to come from HMRC … Continue reading Fake HMRC Company tax credits email delivers Trickbot
Once again I never saw any Trickbot targeting the UK today but have received a US targeted version this evening. This example is an email containing the subject of “FW: Payroll schedule ” pretending to come from Deloitte but actually coming… Continue reading fake Deloitte FW: Payroll schedule delivers Trickbot
A slight change to the Trickbot malware delivery campaign in UK this morning. They are not actually imitating, spoofing or pretending to be any well known company, business or Government department. Instead they have registered a generic domain using o… Continue reading trickbot delivered by Internal only email with macro excel attachments
I didn’t see any Trickbot targeting the UK directly today but have received this Canadian version later on this afternoon UK time. This example is an email containing the subject of “I have securely shared file(s) with you” pretendin… Continue reading trickbot delivered via macro excel spreadsheet fake KPMG FY18 Q4 Personnel and Direct Costs email
A bit of a change with the Trickbot delivery system this morning in UK. They are using macro enabled XLS spreadsheet files instead of the usual word docs. This example is an email containing the subject of “September 2018 Payroll Timetable”… Continue reading Trickbot delivered by fake PWC September 2018 Payroll Timetable using excel macro spreadsheets
This example is an email containing the subject of “WebFiling Authentication Code” pretending to come from Companies House but actually coming from “web-filing@companiesshouse.co.uk” which is a look-a-like, typo-squatted or oth… Continue reading Fake Companies House WebFiling Authentication Code delivers Trickbot