Trickbot is the most prolific malware operation using COVID-19 themed lures

guest · Apr 18, 2020

Trickbot is the most prolific malware operation using COVID-19 themed lures
April 18, 2020
https://securityaffairs.co/wordpress/101824/cyber-crime/trickbot-covid-19-themed-lures.html

The analysis of Microsoft Office 365 ATP data revealed that TrickBot is, at the moment, the malware operation with the highest number of unique COVID-19-themed malicious emails and attachments.

Based on Office 365 ATP data, Trickbot is the most prolific malware operation using COVID-19 themed lures. This week’s campaign uses several hundreds of unique macro-laced document attachments in emails that pose as message from a non-profit offering free COVID-19 test. pic.twitter.com/V2JcZg2kjt
— Microsoft Security Intelligence (@MsftSecIntel) April 17, 2020

Microsoft experts revealed that this campaign observed this week uses several hundreds of unique weaponized attachments in emails that pose as a message from a non-profit offering free COVID-19 test.
Upon opening the documents, victims are tricked into enabling the macros that use a delay before downloading the malicious payloads to evade sandbox analysis and emulation.
Click to expand...

guest · May 1, 2020

TrickBot Attack Exploits COVID-19 Fears with DocuSign-Themed Ploy
May 1, 2020
https://threatpost.com/trickbot-attack-covid-19docusign-themed-malw/155391/

Threat actors are using people’s interest in the Department of Labor’s Family and Medical Leave Act (FMLA) to spread what appears to be the TrickBot trojan in a new spam campaign that security researchers discovered recently.

Recent analysis from spam honeypots set by IBM X-Force discovered actors targeting email recipients with fake messages that claim to be from the department to inform people of changes to the FMLA, which gives employees the right to family-leave medical benefits, according to a post by IBM security analyst Ashkan Via. Instead, the emails include malicious attachments aimed at installing what researchers believe is the TrickBot malware, they said.

“Users infected with the TrickBot Trojan will see their device become part of a botnet that can allow attackers to gain complete control of the device,” Via, along with IBM X-Force co-authors David Bryant and Limor Kessem, wrote in the post.
The threat actors behind the latest campaign also are some of the myriad taking advantage of the COVID-19 pandemic and resulting economic crisis, which has many in the United States seeking financial support through federal government programs.
Click to expand...

However, researchers said the new campaign follows “similar patterns” found previously used by TrickBot, such as the “Macro on Close” function followed by the DocuSign theme.

“Once opened, the document asks the recipient to enable macros (ThisDocument.cls), from which, upon closing the file, malicious scripts will be launched to fetch the malware from the attacker’s designated domain,” researchers wrote.
IBM X-Force researchers attributed the campaign to the “endless amounts of spam and attacks targeting users across the globe” due to the COVID-19 pandemic.
Click to expand...

IBM X-Force: TrickBot Campaigns Targeting Users via Department of Labor FMLA Spam

guest · Jul 26, 2020

Analysis of TrickBot Malware – the most prolific COVID-19 themed malware
July 23, 2020
https://lifars.com/2020/07/analysis-of-trickbot-malware-the-most-prolific-covid-19-themed-malware/

During the 2020 COVID-19 pandemic, TrickBot gained a lot of attention from cybersecurity professionals, as it was named the most prolific malware using COVID-19 as a lure by Microsoft. Infected e–mails usually offered free testing, welfare or pandemic-related legal documents.
The goal of such e-mails is always to convince user to open and download malicious files.

When malicious documents are opened, TrickBot authors use social engineering techniques centered around compatibility issues with Microsoft Office to persuade user into disabling security restrictions and running heavily-obfuscated VBA macros [...]
Conclusion:
Modular architecture, frequent updates and advanced techniques make TrickBot both hard to detect and extremely dangerous. With many credential stealing modules, TrickBot can easily spread and infect multiple departments or even an entire company. This has allowed TrickBot to stay relevant for all these years.
Click to expand...

Log in or Sign up

Trickbot is the most prolific malware operation using COVID-19 themed lures

guest Guest

guest Guest

guest Guest

Log in or Sign up

Trickbot is the most prolific malware operation using COVID-19 themed lures

guest Guest

guest Guest

guest Guest

Useful Searches