Loading story…
TrickBot operators continued to expand the malware’s modular toolkit with components for credential theft, Remote Desktop Protocol brute-forcing, and network reconnaissance. Reporting on the rdpscanDll module showed it could receive targets, usernames, password candidates, and operating modes from command-and-control servers, then generate tailored credential guesses by transforming usernames, domains, hostnames, and IP-derived data rather than relying on a static password list. Separate analysis of TrickBot’s password-grabber updates found the malware targeting browser credentials, cookies, Active Directory data, and PuTTY SSH secrets, while also attempting to collect OpenSSH private keys and OpenVPN credentials and configurations from infected Windows systems.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
By November 2020, the TrickBot gang was using a new PowerShell-based reconnaissance tool dubbed LightBot in phishing campaigns previously associated with BazarLoader. The malware profiled infected hosts and Active Directory environments to identify high-value targets for follow-on attacks.
As of 2020-08-14, analysis of Trickbot's rdpscanDll identified 91 transformation rules used to generate target-specific credential guesses from usernames, domains, hostnames, IP addresses, and other values.
Bitdefender had already published a report in March 2020 on Trickbot's rdpscanDll module, which brute-forces Remote Desktop Protocol servers.
In early November 2019, observers saw two new HTTP POST request types from Trickbot's pwgrab64 module indicating attempts to collect OpenSSH private keys and OpenVPN passwords and configurations. The functionality appeared incomplete or broken because the requests lacked actual stolen data even in lab tests.
Unit 42 described Trickbot as malware first seen in 2016 that steals system information, login credentials, and other sensitive data from Windows hosts using downloadable modules.
Cybereason observed a wave of targeted attacks against financial, manufacturing, and retail organizations in the US and Europe that began with TrickBot infections and escalated to deployment of the newly identified Anchor and Anchor_DNS malware. The campaign selectively targeted high-value victims, including point-of-sale systems, and showed overlap with FIN6 tradecraft.
The cyber.wtf researcher observed that Trickbot's RDP scanner module was again being distributed among bots and found its command-and-control behavior largely unchanged from earlier reporting. The analysis also determined that the module's password candidates were dynamically transformed rather than drawn from a static dictionary.
TrickBot operators mistakenly distributed a test version of grabber.dll that displayed a visible warning to infected users in their browser instead of remaining stealthy. Researcher Vitali Kremez assessed that the developers likely forgot to remove the test warning before release.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcelabs.bitdefender.com
Open sourcebleepingcomputer.com
Open sourcecyber.wtf
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourcecybereason.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government agencies reported that **TrickBot** continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including **Ryuk** and **Conti** ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected `.docm` files used an `AutoOpen` macro to extract hidden VBScript, write a `.VBE` file to `C:\ProgramData`, rebuild a TrickBot DLL, decode it with `certutil`, and execute it through `regsvr32.exe`, helping the malware evade static and behavioral detection. TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older **`mworm`** propagation module with **`nworm`**, which fetched an encrypted payload over HTTP and executed it **in memory** on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with **MikroTik** routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific **gtag** identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of **`CVE-2017-0144`**, and phishing-driven execution chains that lead to TrickBot installation.
Aug 15, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
Trend Micro reported that the **TrickBot** banking trojan added a new password-grabber module, extending the malware’s capabilities beyond its established role in financial fraud and post-compromise activity. The module was designed to harvest stored credentials from infected systems, giving operators another way to steal account access and deepen persistence inside victim environments. The update underscored TrickBot’s continued evolution as a modular malware platform, with new components allowing attackers to tailor infections for credential theft and broader follow-on intrusion. By adding password collection to its toolkit, TrickBot increased the risk of account compromise across enterprise and consumer systems and strengthened its value as a flexible malware service for cybercriminal operations.
Jul 12, 2026