Category Archives: TrickBot

TrickBot Bolsters Layered Defenses to Prevent Injection Research

Posted on by

This post was written with contributions from IBM X-Force’s Limor Kessem and Charlotte Hammond. The cyber crime gang that operates the TrickBot Trojan, as well as other malware and ransomware attacks, has been escalating activity. As part of that escalation, malware injections have been fitted with added protection to keep researchers out and get through […]

The post TrickBot Bolsters Layered Defenses to Prevent Injection Research appeared first on Security Intelligence.

Continue reading TrickBot Bolsters Layered Defenses to Prevent Injection Research→

Emotet’s comeback is getting a boost from fellow botnet TrickBot

Posted on by

The resurgence of botnet Emotet after a law enforcement takedown earlier this year is getting a boost from fellow crime group TrickBot, researchers at Check Point have found. Since November, Check Point has identified 113 new Emotet targets in the first week of December, nearly half its infection right before it was taken down. Emotet attempted to infect 657 new organizations (219 per week) during January 2020. And it was already at 113 new targets in the first week of December 2020. This means that in 3 weeks since its comeback, Emotet already gained 50% of its infection rate before it was taken down. The samples of the Emotet malware are being delivered via servers that TrickBot infected in mid-November. A number of other researchers have confirmed Emotet’s return and have observed TrickBot distributing the malware. Emotet received a series of debilitating blows last year at the hands of law […]

The post Emotet’s comeback is getting a boost from fellow botnet TrickBot appeared first on CyberScoop.

Continue reading Emotet’s comeback is getting a boost from fellow botnet TrickBot→

Cyber Command boss acknowledges US military actions against ransomware groups

Posted on by

The U.S. military has taken offensive measures against ransomware groups, U.S. Cyber Command leader General Paul M. Nakasone confirmed Saturday. “Before, during and since, with a number of elements of our government, we have taken actions and we have imposed costs,” Nakasone told The New York Times in an interview Saturday. “That’s an important piece that we should always be mindful of.” CNN confirmed the offensive cyber operations to disrupt foreign ransomware groups with a U.S. Cyber Command spokesperson. U.S. Cyber Command, the military’s top hacking unit, has reportedly been going after criminal hacking groups dating back to before the 2020 election, when it attempted to knock out TrickBot, a network of infected computers used to deliver malware. More recently, U.S. Cyber Command had role in shutting down ransomware group REvil’s operations, working with foreign governments to redirect traffic from the group’s website, The Washington Post first reported in November. Both […]

The post Cyber Command boss acknowledges US military actions against ransomware groups appeared first on CyberScoop.

Continue reading Cyber Command boss acknowledges US military actions against ransomware groups→

Emotet malware reemerges, building botnet via Trickbot malware

Posted on by

By Deeba Ahmed
Bad news for the cybersecurity fraternity. Emotet malware that was dubbed the World’s Most Dangerous and Widely Spread Malware is back.
This is a post from HackRead.com Read the original post: Emotet malware reemerges, building botnet vi… Continue reading Emotet malware reemerges, building botnet via Trickbot malware→

Alleged Trickbot malware gang member extradited to United States, and appears in court

Posted on by

A 38-year-old Russian national has appeared in a US federal court, after being extradited from South Korea, to face charges of his alleged involvement in the notorious Trickbot malware gang.

Read more in my article on the Hot for Security blog. Continue reading Alleged Trickbot malware gang member extradited to United States, and appears in court→

Russian national allegedly behind TrickBot malware extradited to US, makes court appearance

Posted on by

Vladimir Dunaev, a Russian national accused of being part of the group behind the notorious TrickBot malware, appeared in federal court in Ohio on Thursday after being extradited from South Korea. Dunaev is facing several charges related to computer fraud, bank fraud, wire fraud, money laundering and identity theft. He pleaded not guilty and could face up to 60 years in prison if convicted of all charges. The TrickBot malware, which dates back to at least 2016, was originally a Trojan that allowed attackers to steal financial data. But it evolved over time into a “highly modular, multi-stage malware that provides its operators a full suite of tools to conduct a myriad of illegal cyber activities,” the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency said in a notice earlier this in March. Three months after that CISA notice, U.S. prosecutors unsealed an indictment alleging that a Latvian woman, […]

The post Russian national allegedly behind TrickBot malware extradited to US, makes court appearance appeared first on CyberScoop.

Continue reading Russian national allegedly behind TrickBot malware extradited to US, makes court appearance→

Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds

Posted on by

IBM X-Force has been tracking the activity of ITG23, a prominent cybercrime gang also known as the TrickBot Gang and Wizard Spider. Researchers are seeing an aggressive expansion of the gang’s malware distribution channels, infecting enterprise users with Trickbot and BazarLoader. This move is leading to more ransomware attacks — particularly ones using the Conti […]

The post Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds appeared first on Security Intelligence.

Continue reading Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds→

Emergent ransomware gang FIN12 strikes hospitals, moves quickly against big targets

Posted on by

A Russian-speaking ransomware gang in recent months has aggressively targeted North American organizations with more than $300 million in revenue, with a ruthless focus on the health care sector amid the COVID-19 pandemic, according to new findings. The threat intelligence firm Mandiant published details Thursday about a group it calls FIN12, a gang that moves quickly and uses an array of established hacking tools to infiltrate its targets. Over the past year, hackers have kept investigators busy, accounting for 20% of the ransomware incidents that Mandiant has responded to, with the next highest attackers at 5%, according to Kimberly Goody, the company’s director of cyber crime analysis. “They have a significantly higher cadence of attacks from our perspective,” she said. “We also see that, unlike other threat actors, this group has also aggressively pursued victims in critical sectors like health care, even during the pandemic, which had resulted in several actors saying that […]

The post Emergent ransomware gang FIN12 strikes hospitals, moves quickly against big targets appeared first on CyberScoop.

Continue reading Emergent ransomware gang FIN12 strikes hospitals, moves quickly against big targets→

Alleged Russian malware developer arrested after being stranded in South Korea due to COVID-19 pandemic

Posted on by

I hate to give advice to those who work for cybercrime gangs, but maybe – if they care about their liberty – they should think long and hard before making any international travel plans.

Read more in my article on the Hot for Security blog. Continue reading Alleged Russian malware developer arrested after being stranded in South Korea due to COVID-19 pandemic→