Attacks Aimed at Disrupting the Trickbot Botnet

mood · Oct 2, 2020

Attacks Aimed at Disrupting the Trickbot Botnet
October 2, 2020
https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/

Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt Trickbot, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying ransomware within compromised organizations.

On Sept. 22, someone pushed out a new configuration file to Windows computers currently infected with Trickbot.
But the new configuration file pushed on Sept. 22 told all systems infected with Trickbot that their new malware control server had the address 127.0.0.1, which is a “localhost” address that is not reachable over the public Internet, according to an analysis by cyber intelligence firm Intel 471.

It’s not known how many Trickbot-infected systems received the phony update, but it seems clear this wasn’t just a mistake by Trickbot’s overlords.
Click to expand...

Intel 471 CEO Mark Arena said it’s anyone’s guess at this point who is responsible.

“Obviously, someone is trying to attack Trickbot,” Arena said. “It could be someone in the security research community, a government, a disgruntled insider, or a rival cybercrime group. We just don’t know at this point.”
“Our monitoring found at least one statement from one of the ransomware groups that relies on Trickbot saying this [***] them off, and they’re going to double the ransom they’re asking for from a victim,” Holden said.
Click to expand...

mood · Oct 10, 2020

Report: U.S. Cyber Command Behind Trickbot Tricks
October 10, 2020
https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/

A week ago, KrebsOnSecurity broke the news that someone was attempting to disrupt the Trickbot botnet, a malware crime machine that has infected millions of computers and is often used to spread ransomware. A new report Friday says the coordinated attack was part of an operation carried out by the U.S. military’s Cyber Command.

In a story published Oct. 9, The Washington Post reported that four U.S. officials who spoke on condition of anonymity said the Trickbot disruption was the work of U.S. Cyber Command, a branch of the Department of Defense headed by the director of the National Security Agency (NSA).
The Post said U.S. officials recognized their operation would not permanently dismantle Trickbot, describing it rather as “one way to distract them for at least a while as they seek to restore their operations.”
Click to expand...

Holden said the Trickbot operators have begun rebuilding their botnet, and continue to engage in deploying ransomware at new targets.
“They are running normally and their ransomware operations are pretty much back in full swing,” Holden said. “The are not slowing down because they still have a great deal of stolen data.”
Click to expand...

mood · Oct 12, 2020

Microsoft and others orchestrate takedown of TrickBot botnet
FS-ISAC, ESET, Lumen’s Black Lotus Labs, NTT, Symantec, and the Microsoft Defender team participated in the takedown
October 12, 2020
https://www.zdnet.com/article/micro...nies-orchestrate-takedown-of-trickbot-botnet/

A coalition of tech companies has announced today a coordinated effort to take down the backend infrastructure of the TrickBot malware botnet.

Companies and organizations which participated in the takedown included Microsoft's Defender team, FS-ISAC, ESET, Lumen's Black Lotus Labs, NTT, and Broadcom's cyber-security division Symantec.
Preceding the takedown were investigations from all participants into TrickBot's backend infrastructure of servers and malware modules.
Click to expand...

Microsoft, ESET, Symantec, and partners spent months collecting more than 125,000 TrickBot malware samples, analyzing their content, and extracting and mapping information about the malware's inner workings, including all the servers the botnet used to control infected computers and serve additional modules.
With this information in hand, Microsoft went to court this month and asked a judge to grant it control over TrickBot servers.

"With this evidence, the court granted approval for Microsoft and our partners to disable the IP addresses, render the content stored on the command and control servers inaccessible, suspend all services to the botnet operators, and block any effort by the TrickBot operators to purchase or lease additional servers," Microsoft said in a press release today.
Click to expand...

The success of this takedown is, however, yet to be seen. Many other botnets have survived similar takedowns in the past. The best example of this is the Kelihos botnet, which survived three takedown attempts, rebuilding from scratch and continuing to operate.
Click to expand...

ronjor · Oct 12, 2020

Microsoft Uses Trademark Law to Disrupt Trickbot Botnet 12 Oct 2020
Microsoft Corp. has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot, a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder infected systems, based on novel claims that the crime machine abused the software giant’s trademarks. However, it appears the operation has not completely disabled the botnet.
Click to expand...

https://krebsonsecurity.com/2020/10/microsoft-uses-copyright-law-to-disrupt-trickbot-botnet/

Minimalist · Oct 13, 2020

ESET takes part in global operation to disrupt Trickbot

Trickbot has infected over a million computing devices around the world since late 2016 and we have been tracking its activities since the beginning. In 2020 alone, our automatic platform analyzed more than 125,000 malicious samples and downloaded and decrypted more than 40,000 configuration files used by the different Trickbot modules, giving us an excellent viewpoint of the different C&C servers used by this botnet.
Click to expand...

https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/

mood · Oct 20, 2020

Ryuk Ransomware Attacks Continue Following TrickBot Takedown Attempt
October 19, 2020
https://www.securityweek.com/ryuk-ransomware-attacks-continue-following-trickbot-takedown-attempt

Referred to as WIZARD SPIDER, the adversary has been widely using TrickBot for the distribution of ransomware, and the recent attempts by the U.S. Cyber Command and Microsoft to disrupt the botnet were expected to put an end to such operations.

However, the efforts had little effect on the botnet, and the threat actor is apparently able to continue operations at the same pace as before. With over one million infected machines, TrickBot represents a serious threat.

“The operation against the TrickBot network was orchestrated to take down the botnet, thus reducing BGH infections by WIZARD SPIDER’s Ryuk and Conti ransomware families, with an ultimate goal of protecting the forthcoming U.S. elections from ransomware operations,” CrowdStrike notes.
TrickBot’s operators quickly switched to secondary channels to ensure their operations could continue. Emotet started deploying TrickBot last week, and WIZARD SPIDER added BazarLoader into the mix, an initial access tool the threat actor has used before.
Click to expand...

[...] the security firm notes.
“The ultimate goal of the disruption operation against the TrickBot network was to impact and prevent ransomware infections […]. While the valiant efforts of the cybersecurity teams involved in this complex operation undoubtedly had a short-term impact on WIZARD SPIDER’s TrickBot network, the response by the criminal actors has been swift, effective and efficient,” Crowdstrike concludes.
Click to expand...

mood · Oct 20, 2020

TrickBot malware under siege from all sides, and it's working
October 20, 2020
https://www.bleepingcomputer.com/ne...e-under-siege-from-all-sides-and-its-working/

The Trickbot malware operation is on the brink of completely shutting down following efforts from an alliance of cybersecurity and hosting providers targeting the botnet’s command and control servers.

Initial disruption actions seemed to leave the botnet unphased as its operators were able to rebuild the infrastructure and the network of infected computers.
Although the battle is not over yet, the latest score in the fight against Trickbot clearly shows that the work of the coalition headed by Microsoft’s Digital Crimes Unit (DCU) has had a serious impact.
Click to expand...

TrickBot faces coordinated takedown operation
The partners knew right off the bat that this initial salvo would not bring down Trickbot and described it as an ongoing disruption effort with no guarantee of completely taking down the botnet.

Last week, cybersecurity company Intel 471 saw that Trickbot continued to infect new computers, helped by its long time partner, Emotet, which also spreads QBot.

“The Emotet bots reached out to their controllers and received commands to download and execute Trickbot on victim machines. The Trickbot group tag that Intel 471 identified is tied to a typical infection campaign that information security researchers have been observing for the past 6 months or more” - Intel 471
A bounce back was expected
Researchers at Lumen’s Black Lotus Labs told BleepingComputer that Trickbot administrators are constantly rotating the C2 IP addresses and change the infected hosts, making disruption efforts a serious challenge.
Click to expand...

The tables are turning
In a blog post today, Microsoft provides an update on the Trickbot disruption operation saying that together with its partners across the world they worked to disable 94% of Trickbot’s critical infrastructure.

“As of October 18, we’ve worked with partners around the world to eliminate 94% of Trickbot’s critical operational infrastructure including both the command-and-control servers in use at the time our action began and new infrastructure Trickbot has attempted to bring online” - Microsoft
Click to expand...

Microsoft: An update on disruption of Trickbot

Last week, we announced a disruption targeting the botnet Trickbot. Trickbot is a network of servers and infected devices run by criminals responsible for a wide range of nefarious activity including the distribution of ransomware which can lock up computer systems.

Our disruption is intended to disable Trickbot’s infrastructure and make it difficult for its operators to enable ransomware attacks, which have been identified as one of the biggest threats to the upcoming U.S. elections. We’ve had many requests for updates on the operation, so I’d like to share more on how it’s going.
Click to expand...

mood · Oct 28, 2020

TrickBot Linux Variants Active in the Wild Despite Recent Takedown
October 28, 2020
https://thehackernews.com/2020/10/trickbot-linux-variants-active-in-wild.html

Efforts to disrupt TrickBot may have shut down most of its critical infrastructure, but the operators behind the notorious malware aren't sitting idle.

According to new findings shared by cybersecurity firm Netscout, TrickBot's authors have moved portions of their code to Linux in an attempt to widen the scope of victims that could be targeted.
But over the past few weeks, twin efforts led by the US Cyber Command and Microsoft have helped to eliminate 94% of TrickBot's command-and-control (C2) servers that were in use and the new infrastructure the criminals operating TrickBot attempted to bring online to replace the previously disabled servers.

Despite the steps taken to impede TrickBot, Microsoft cautioned that the threat actors behind the botnet would likely make efforts to revive their operations.
Click to expand...

TrickBot's Anchor Module
At the end of 2019, a new TrickBot backdoor framework called Anchor was discovered using the DNS protocol to communicate with C2 servers stealthily.
The variant, dubbed "Anchor_DNS," enables the infected client to utilize DNS tunneling to establish communications with the C2 server, which in turn transmits data with resolved IPs as a response, NTT researchers said in a 2019 report.

But a new sample uncovered by Stage 2 Security researcher Waylon Grange in July found that Anchor_DNS has been ported to a new Linux backdoor version called "Anchor_Linux."

"Often delivered as part of a zip, this malware is a lightweight Linux backdoor," Grange said. "Upon execution it installs itself as a cron job, determines the public IP [address] for the host and then begins to beacon via DNS queries to its C2 server."
Click to expand...

Netscout: Dropping the Anchor

Trickbot has long been one of the key banking malware families in the wild.

Despite recent disruption events, the operators continue to drive forward with the malware and have recently begun porting portions of its code to the Linux operating system. As this technical deep dives shows, the communication between the command-and-control (C2) server and the bot are extremely complex. Additionally, we have analyzed the C2 communication process of the Linux2 version of Trickbots’ Anchor module.
Click to expand...

mood · Nov 14, 2020

Like the Energizer Bunny, Trickbot Goes On and On
Recent efforts to take down the virulent botnet have been largely -- but not entirely -- successful
November 12, 2020
https://www.darkreading.com/threat-...bunny-trickbot-goes-on-and-on-/d/d-id/1339432

Operators of the Trickbot botnet that has infected more than 1 million systems worldwide with ransomware and other malware are providing a textbook example of just how difficult it can be to truly take out international cybercrime operations.

Weeks after US Cyber Command, Microsoft, and several others took coordinated action to extensively disrupt Trickbot activity, there are signs the botnet operators have still not fully given up yet.
Threat intelligence firm Intel 471 this week reported it had observed signs that a new version of Trickbot is being distributed via spam even as the operators of the malware have begun using a different tool known as BazarLoader to distribute Ryuk ransomware.
Click to expand...

It's presently unclear whether Trickbot operators have switched completely to BazarLoader or if they would return to using the Trickbot botnet at a later date, the threat intelligence firm said in a report this week.
The Ryuk ransomware version that's being distributed in growing numbers has also been associated with Trickbot, Intel 471 said.

"Throughout the takedown efforts carried out by security practitioners, Trickbot operators have continuously attempted to spin up new [command-and-control] instances," Clark says. "[As a result], Trickbot operators still maintain access to non-US-based infrastructure, allowing them to continue their attacks."
Click to expand...

"It's expected that they will invest greater efforts in redundancy, including globally distributed command-and-control servers and backup command-and-control methods that are resistant to takedowns," Arena says. "The only real long-term blow that we expect to be effective at halting Trickbot permanently would be arrests of the criminals behind Trickbot."
Click to expand...

Intel 471: Trickbot down, but is it out?

Since the separate and independent actions taken against Trickbot, we have observed successful disruption of its command and control infrastructure. However, the actors linked to Trickbot have not ceased their criminal activities. These actors have continued engaging in ransomware activity, using BazarLoader instead of Trickbot. We are unable to assess the long-term impact of the Trickbot disruption activity or whether Trickbot will continue to be used by cybercrime groups. This analysis covers the period from Sept. 22, 2020 until Nov. 6, 2020.
Click to expand...

mood · Nov 23, 2020

TrickBot is Dead. Long Live TrickBot!
November 23, 2020
https://labs.bitdefender.com/2020/11/trickbot-is-dead-long-live-trickbot/

TrickBot still crawls despite law enforcement kneecapping operation. It’s operators are scrambling to restore the botnet back to its former glory, Bitdefender researchers have found. An analysis of samples reveals updated communication mechanisms, new C2 infrastructure that uses Mikrotik routers, and packed modules

TrickBot has arguably been one of the most popular Trojans for the past couple of years, used by threat actors mostly because of its modular design and highly resilient infrastructure. Bitdefender researchers even analyzed one of its modules earlier this year, particularly because it targeted telecom, education, and financial services in the US and Hong Kong.
However, when Microsoft decided to take down TrickBot before the US elections, fearing the massive botnet could be used to thwart the voting process in some way, the endeavor proved to be more like a “kneecapping” operation rather than cutting the hydra’s heads.
Click to expand...

Conclusions
Completely dismantling TrickBot has proven more than difficult, and similar operations in the past against popular Trojans has proven that the cybercriminal community will always push to bring back into operation something that’s profitable, versatile and popular. TrickBot might have suffered a serious blow, but its operators seem to be scrambling to bring it back, potentially more resilient and difficult to extirpate than ever before.
Click to expand...

mood · Nov 24, 2020

TrickBot Gets Updated to Survive Takedown Attempts
November 24, 2020
https://www.securityweek.com/trickbot-gets-updated-survive-takedown-attempts

On October 12, Microsoft announced that, together with several partners, it managed to legally disable existing TrickBot infrastructure and prevent operators from registering additional command and control (C&C) domains.
Soon after, however, the malware was seen continuing operations normally, and security researchers reported that even malware relying on TrickBot’s botnet, such as Ryuk ransomware, was largely unaffected by the operation.
Click to expand...

Now, roughly one month later, security researchers are observing multiple updates being made to TrickBot to increase the botnet’s resilience and improve its reconnaissance capabilities.

Another change observed in TrickBot, this time by Advanced Intel security researcher Vitali Kremez, is the adoption of a fileless DLL loading method copied from the MemoryModule library.
The researcher also noticed the inclusion within TrickBot of a new reconnaissance module called LightBot, which allows the operators to identify targets of interest within the victim’s network. Capable of achieving persistence, LightBot is likely used to identify Ryuk ransomware targets, the researcher says.
Click to expand...

mood · Nov 24, 2020

The researcher also noticed the inclusion within TrickBot of a new reconnaissance module called LightBot
Click to expand...

LightBot: TrickBot’s new reconnaissance malware for high-value targets
November 23, 2020
https://www.bleepingcomputer.com/ne...econnaissance-malware-for-high-value-targets/

The notorious TrickBot has gang has released a new lightweight reconnaissance tool used to scope out an infected victim's network for high-value targets.
LightBot: A lightweight reconnaissance tool
Dubbed LightBot by Advanced Intel's Vitali Kremez, this PowerShell script is a lightweight reconnaissance tool that gathers information about a victim's network to determine if they are high-value and should be targeted in further attacks.

"We suspect LightBot is used as another means (on top of the lightweight covert BazarBackdoor) to handpick Ryuk ransomware targets via network/domain parsing part of Cobalt Strike to Ryuk ransomware kill chain," Kremez told BleepingComputer in a conversation.
Click to expand...

Last month, Microsoft and other security firms performed a coordinated takedown of TrickBot, which impacted their operations. This continued evolution of new tools, though, shows the hacking group's adaptability and resiliency.
All admins should be on the lookout for LightBot phishing campaigns as the end result will likely be a network-wide Ryuk or Conti ransomware attack.
Click to expand...

mood · Nov 30, 2020

It's hard to keep a big botnet down: TrickBot sputters back toward full health
November 30, 2020
https://www.cyberscoop.com/trickbot-status-microsoft-cyber-command-takedown/

Mounting evidence suggests that TrickBot, the vast botnet that both U.S. Cyber Command and a Microsoft-led coalition sought to disable around the 2020 elections, is on the mend and evolving.

Hints of its rebound began in late October, shortly after signs of success in the bids to dismantle the TrickBot network of zombie computers. While Cyber Command and Microsoft always billed their assaults as a disruption rather than a full takedown, the TrickBot comeback is proof that it’s difficult to kill a botnet outright.

“We believe that this shows a determination on the part of the actors behind Trickbot to defy the disruption activity against their operation,” Mark Arena, CEO of Intel 471, said via email.
Huntress Labs published an analysis of the new obfuscation scheme last week. It’s simple, but clever, said Brian Hammond, senior security researcher.
Click to expand...

It is possible to fully destroy a botnet, as the case of 3ve shows. 3ve began operation in 2013, and ended in 2018 when a joint operation between government agencies and technology companies including Google brought it down. But in the case of TrickBot, as Bitdefender put it, “the endeavor proved to be more like a ‘kneecapping’ operation rather than cutting the hydra’s heads.”
Click to expand...

Log in or Sign up

Attacks Aimed at Disrupting the Trickbot Botnet

mood Updates Team

mood Updates Team

mood Updates Team

ronjor Global Moderator

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

Attacks Aimed at Disrupting the Trickbot Botnet

mood Updates Team

mood Updates Team

mood Updates Team

ronjor Global Moderator

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches