A One-two Punch of Emotet, TrickBot, & Ryuk Stealing & Ransoming Data

guest · Apr 2, 2019

A One-two Punch of Emotet, TrickBot, & Ryuk Stealing & Ransoming Data
The Cybereason team has identified a campaign that incorporates Emotet, TrickBot, and the Ryuk ransomware
April 2, 2019
https://www.cybereason.com/blog/one-two-punch-emotet-trickbot-and-ryuk-steal-then-ransom-data

This research gives unique detail to each phase of the campaign, from Emotet’s use as an infrastructure to deliver TrickBot, to TrickBot’s information stealing capabilities, lateral movement, and use as a downloader for Ryuk, and finally to Ryuk’s ransomware capabilities.

This campaign used many advanced persistence, lateral movement, and detection evasion measures, including attempts to disable Windows Defender, the use of EternalBlue to spread, and the stopping of multiple services and processes related to anti malware products.
THE TRIPLE THREAT CAMPAIGN [...]
Click to expand...

guest · Apr 15, 2020

Emotet, Ryuk, TrickBot: 'Loader-Ransomware-Banker Trifecta'
More Advanced Cybercrime Services Help Hackers Boost Illicit Earnings
April 15, 2020
https://www.databreachtoday.com/emotet-ryuk-trickbot-loader-ransomware-banker-trifecta-a-14126

Rather than building their own attack tools, many criminals are continuing to use cybercrime platforms and services to make it easier to earn an illicit paycheck. Some gangs are also combining tools in an attempt to earn even more.

For example, a large number of attacks today combine Emotet, Ryuk and TrickBot. "This loader-ransomware-banker trifecta has wreaked havoc in the business world over the past two years, causing millions of dollars in damages and ransoms paid," says cybercrime intelligence firm Intel 471 in a new report.
TrickBot is one of many malware-as-a-service offerings that allow attackers to focus on infecting systems, while in effect outsourcing the development and maintenance of the malware they use, typically in return for a subscription fee.
Click to expand...

Cybercrime Trifecta
On their own, any of these pieces of malware can wreak plenty of havoc. By combining forces, however, they can do even more damage.

And one of the more problematic tie-ups remains the crossover between attackers who wield the sophisticated strain of malware called Emotet, which started life as a banking Trojan, together with TrickBot and Ryuk ransomware.
Ryuk, which is based on Hermes ransomware, was first spotted in August 2018. Since then, its developers have continued to refine the code.

Not every Emotet, TrickBot or Ryuk infection necessarily involves more than one of those pieces of malware being installed. But incident responders should assume that when they find one, more might have also been pushed into an IT environment.
Click to expand...

Target: Active Directory
Emotet, TrickBot and Ryuk sometimes get seen as standalone in attacks, experts say, but they also often appear together. "Many of the Ryuk incidents we've been privy to have involved both Emotet and TrickBot," Intel 471 says.
Even so, such attacks typically unfold in very specific ways, beginning with Emotet being used as a downloader for TrickBot, [...] The final stage can include installing of Ryuk as a money-making coup de grâce.
Click to expand...

Intel 471: Understanding the relationship between Emotet, Ryuk and TrickBot

By the Intel 471 Malware Intelligence team. One of the more notable relationships in the world of cybercrime is that between Emotet, Ryuk and TrickBot. This loader-ransomware-banker trifecta has wreaked havoc in the business world over the past two years, causing millions of dollars in damages and ransoms paid.

Our Malware Intelligence team receives a lot of great questions from our clients on this subject, so we thought it would be good to do a Q/A style blog covering some of the more general questions.
Click to expand...

Log in or Sign up

A One-two Punch of Emotet, TrickBot, & Ryuk Stealing & Ransoming Data

guest Guest

guest Guest

Log in or Sign up

A One-two Punch of Emotet, TrickBot, & Ryuk Stealing & Ransoming Data

guest Guest

guest Guest

Useful Searches