Loading malware…
TrickBot is a modular Windows banking trojan first observed in 2016 that evolved into a credential-theft, network-propagation, and malware-delivery platform. It has been closely associated with the Wizard Spider and Conti cybercriminal ecosystem and has provided initial access and post-exploitation capabilities for attacks deploying Ryuk and Conti ransomware. Emotet has distributed TrickBot as a secondary payload, while TrickBot helped deliver Emotet when that botnet returned in November 2021.
TrickBot downloads DLL-based modules to extend its functionality. Its banking components use web injects, fraudulent banking-site redirection, and form grabbing to steal financial information. Other modules collect browser passwords, cookies, autofill data, browsing history, saved Outlook credentials, and domain credentials. It can extract credentials from Windows authentication processes using Mimikatz, enumerate computers and network devices, and map victim networks. Its propagation modules use stolen credentials and exploit SMB vulnerabilities through EternalBlue and EternalRomance to move laterally. Collected information and credentials are transmitted to command-and-control infrastructure over HTTP and HTTPS.
Distribution commonly involves phishing and malicious spam containing malicious links or macro-enabled Microsoft Word and Excel attachments. Campaigns have impersonated accounting and financial brands and used COVID-19-themed lures, including attacks against Italian users. TrickBot establishes scheduled-task persistence, checks for sandbox environments, attempts to disable antivirus software, and injects code into legitimate Windows processes through native APIs. Its downloaders have also masqueraded as Word documents. Operators have used compromised MikroTik routers as command-and-control proxies, redirecting traffic through non-standard ports to conceal infrastructure and improve its resilience.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
TrickBot spread through the EternalBlue SMB flaw, so patch Windows and disable SMBv1. | TrickBot is a modular trojan that appeared in 2016 as a banking trojan and became a staging platform for ransomware, especially Ryuk and Conti.
TabDll – Uses the EternalRomance exploit (CVE-2017-0147) to spread via SMBv1.
Exploiting CVE-2018-14847 on devices with RouterOS versions older than 6.42. This vulnerability gives the attacker the ability to read arbitrary files like user.dat, which contains passwords.
In Microsoft’s December 14, 2021, Patch Tuesday vulnerability release, security patches were released for a high severity zero-day vulnerability impacting the Windows AppX installer. The vulnerability is tracked as CVE-2021-43890 (CVSS: 7.1). Exploitation allows a threat actor to create a malicious file that appears to be a legitimate application. Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader. | Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader.
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders. | Additionally, some of the infrastructure that hosted the oleObjects utilized in the August 2021 attacks abusing CVE-2021-40444 were also involved in the delivery of BazaLoader and Trickbot payloads — activity that overlaps with a group Microsoft tracks as DEV-0193.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
25 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TrickBot is a modular trojan that appeared in 2016 as a banking trojan and became a staging platform for ransomware, especially Ryuk and Conti.
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware
“Prior to this threat, Storm-0324 had the following range of payload distribution: ... Trickbot.”
Drawing inspiration from Dyre (or Dyreza), Trickbot consists of an ecosystem of plugin modules and helper components.
"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 256 publickeys: 183"
However, also in 2017, it was observed delivering the Trojan.Trickybot and Ransom.UmbreCrypt ransomware.
46 distinct techniques documented for this family, organized by ATT&CK tactic.
1,743 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Steals credentials, maps networks, and moves laterally to prepare ransomware deployment. The article describes operator overlap with Conti, exploitation-based propagation, and assistance in rebuilding Emotet after its takedown.
Mentioned as part of the historical WIZARD SPIDER/SystemBC lineage and a single possible JA3 fingerprint detection, not as a confirmed payload in this operation.
Malware managed by the Russian group experts linked to the Ryuk ransomware gang; no further capabilities are described in the content.
The content identifies TrickBot as malware managed by the Russian group tied to the Ryuk ransomware operation; no further capabilities are provided.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.