Loading story…
Microsoft said it obtained a court order and worked with telecommunications providers and cybersecurity partners to disrupt the Trickbot botnet, a major malware platform used to steal credentials and deliver follow-on threats including ransomware. The action targeted Trickbot's command-and-control infrastructure and supporting services, with Microsoft using legal measures including trademark claims to seize or disable servers and cut communications between infected devices and operators.
Reporting tied the operation to concerns that Trickbot could be used to support disruptive cyber activity against U.S. election-related networks, while security researchers noted that separate technical attacks had also been launched against the botnet's backend systems before the legal takedown. The combined effort was described as a significant but likely temporary setback for the criminal group, because Trickbot's operators had shown the ability to rebuild infrastructure and restore portions of the network after prior disruptions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft, working with telecommunications providers and industry partners, announced it had begun disabling Trickbot infrastructure by cutting off key services and suspending malicious servers. The disruption was framed as an effort to reduce the risk that Trickbot could be used to deploy ransomware or otherwise interfere with election-related systems.
Microsoft said it secured a court order from a Virginia federal court authorizing action against Trickbot's infrastructure, using evidence that the botnet operators abused Microsoft's trademarks in phishing and malware campaigns. The legal action targeted IP addresses, command-and-control servers, and other infrastructure used to operate Trickbot.
Security researchers told KrebsOnSecurity that U.S. Cyber Command had launched operations aimed at interfering with the Trickbot botnet's command-and-control infrastructure. The effort was described as an attempt to blunt the botnet ahead of the 2020 U.S. election.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blogs.microsoft.com
Open sourcenytimes.com
Open sourcetheregister.com
Open sourcemicrosoft.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Cyber Command and Microsoft led parallel efforts to disrupt the **TrickBot** botnet, a major criminal infrastructure used to distribute ransomware and viewed as a potential threat to U.S. election security. Microsoft said it disabled **120 of 128** identified servers through court orders and coordination with hosting providers, ISPs, and international partners, while U.S. officials described a separate military operation intended to temporarily knock the botnet off balance and force its operators to spend time rebuilding rather than launching attacks. Earlier reporting had already shown TrickBot expanding beyond banking malware into large-scale email abuse through its **TrickBooster** module, which harvested credentials and contacts, sent spam from compromised accounts, and was tied to a database containing roughly **250 million** harvested email addresses. The disruption did not eliminate the threat. Incident responders documented a late-2020 intrusion in which TrickBot operators manually deployed malware, used **Cobalt Strike** for privilege escalation and lateral movement, dumped `LSASS` and `NTDS.dit`, and conducted extensive Active Directory reconnaissance consistent with a likely **Ryuk** ransomware attack path. By the end of 2021, reporting indicated that the **Conti** ransomware group had absorbed key TrickBot personnel and become the botnet’s primary user, with plans to shift initial access operations toward **BazarBackdoor**. The FBI also linked **Diavol** ransomware to the TrickBot group, underscoring how the operation persisted after takedowns and continued to serve as a core access and development hub for multiple ransomware campaigns.
Aug 15, 2026
The operators behind **TrickBot** dismantled much of the botnet’s server infrastructure after months of declining activity, bringing a major cybercrime platform close to an apparent end. Security researchers said the malware had become less effective because its traffic was easier to detect and its infrastructure had been repeatedly disrupted by actions from Microsoft, U.S. Cyber Command, and law enforcement. TrickBot had evolved from a banking trojan into a modular malware platform used for credential theft, lateral movement, and delivery of additional payloads, and it was still seen on more than 140,000 systems during 2021 despite sustained pressure. The shutdown did not end the threat from the people behind the operation. Reporting tied key **TrickBot** members and developers to the **Conti** ransomware group, which was already using related tooling such as **BazarBackdoor** and, in some assessments, benefiting from overlap with **Emotet**-linked access operations. U.S. authorities had also moved against alleged members, including the extradition of Russian national **Vladimir Dunaev** and charges against programmer **Alla Witte**, underscoring that while the TrickBot botnet was being retired, its operators and tradecraft were being absorbed into other ransomware and initial-access ecosystems.
Aug 15, 2026
Trickbot recovered from a major 2020 disruption campaign and continued operating as a modular malware platform tied to credential theft, lateral movement, brute forcing, proxying, and ransomware delivery. Microsoft said its court-backed operation with hosting providers, ISPs, and industry partners disabled **120 of 128** identified Trickbot servers, including most core infrastructure, while the remaining systems included compromised IoT devices used for command-and-control. Despite that action, operators rapidly worked to restore infrastructure, and later reporting described Trickbot activity in **149 countries**, with more than **140,000** observed victims and **223 campaigns** over six months. Researchers said the botnet evolved well beyond its banking Trojan origins into a flexible post-compromise framework linked to **Ryuk**, **Conti**, **BazarBackdoor**, and **Anchor**, with modules for Active Directory theft, browser interception, spam propagation, network scanning, RDP and OWA brute forcing, SQL discovery, and worm-like spread using **EternalBlue** and **EternalRomance**. In late 2021, Trickbot also began distributing **Emotet** again, helping drive the malware’s return after its takedown; observed infection chains used password-protected ZIP archives and malicious Excel files that launched PowerShell to download payloads into `C:\ProgramData`, underscoring the botnet’s continued role as a high-risk loader for follow-on malware and ransomware.
Aug 14, 2026