Trickbot again

Researchers have opened the lid on the continued resurgence of the insidious TrickBot malware, Russia-based transnational cybercrime group is working behind the scenes to revamp its attack infrastructure in response to recent counter efforts from law enforcement.

The new capabilities discovered are used to monitor and gather intelligence on victims, using a custom communication protocol to hide data transmissions between servers and victims making attacks difficult to spot.

The threat actor has been found actively developing an updated version of a module called “vncDll” that it employs against select high-profile targets for monitoring and intelligence gathering. The new version has been named “tvncDll.”

The new module is designed to communicate with one of the nine C2 servers defined in its configuration file, using it to retrieve a set of attack commands, download more malware payloads, and exfiltrate gathered from the machine back to the server. Additionally, the researchers said they identified a “viewer tool,” which the attackers use to interact with the victims through the C2 servers.

While efforts to squash the gang’s operations may not have been entirely successful, Microsoft told The Daily Beast that it worked with ISPs to go door-to-door replacing routers compromised with the Trickbot malware in Brazil and Latin America, and that it effectively pulled the plug on Trickbot infrastructure in Afghanistan