Loading story…
The operators behind TrickBot dismantled much of the botnet’s server infrastructure after months of declining activity, bringing a major cybercrime platform close to an apparent end. Security researchers said the malware had become less effective because its traffic was easier to detect and its infrastructure had been repeatedly disrupted by actions from Microsoft, U.S. Cyber Command, and law enforcement. TrickBot had evolved from a banking trojan into a modular malware platform used for credential theft, lateral movement, and delivery of additional payloads, and it was still seen on more than 140,000 systems during 2021 despite sustained pressure.
The shutdown did not end the threat from the people behind the operation. Reporting tied key TrickBot members and developers to the Conti ransomware group, which was already using related tooling such as BazarBackdoor and, in some assessments, benefiting from overlap with Emotet-linked access operations. U.S. authorities had also moved against alleged members, including the extradition of Russian national Vladimir Dunaev and charges against programmer Alla Witte, underscoring that while the TrickBot botnet was being retired, its operators and tradecraft were being absorbed into other ransomware and initial-access ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
Abuse.ch tracking showed new Emotet command-and-control servers were registered on February 24, 2022, the same day TrickBot's shutdown was reported.
Researchers reported that TrickBot's operators formally shut down the botnet infrastructure on February 24, 2022, after months of inactivity and nearly two months of sharply reduced activity.
Abuse.ch tracking showed new BazarLoader command-and-control servers were registered as recently as February 19, 2022, indicating operator activity had shifted to successor tooling.
Abuse.ch's Feodo Tracker showed that no new TrickBot command-and-control servers had been set up since December 16, 2021, marking the start of a prolonged operational lull.
AdvIntel assessed that by the end of 2021, the Conti ransomware operation had effectively acquired TrickBot by bringing multiple elite TrickBot developers and managers into Conti. The report said this gave Conti exclusive access to TrickBot-provided initial access and reduced its reliance on third-party access brokers.
Check Point reported in December 2021 that it had seen TrickBot on more than 140,000 systems during 2021, underscoring the botnet's continued scale despite prior disruptions.
Conti was reported to have resurrected and integrated the Emotet botnet into its attack framework toward the end of 2021, with reporting specifying that this began in November 2021.
In 2021, U.S. authorities charged and detained alleged TrickBot programmers Alla Witte and Vladimir Dunaev, though reporting said the action did not disrupt the group's leadership.
BazarBackdoor first appeared in 2021 after originating as part of TrickBot's modular toolkit, later becoming an autonomous malware family used for enterprise access.
In October 2020, U.S. Cyber Command, Microsoft, law enforcement, and security partners attempted to take down TrickBot command-and-control infrastructure. The effort reportedly knocked out most of its servers, but the botnet recovered within days and resumed attacks weeks later.
Mandiant reported that from the start of its operations until March 2020, FIN12 exclusively used TrickBot-derived access to launch ransomware attacks. This tied FIN12's early intrusion activity directly to the TrickBot ecosystem before the actor later diversified access sources.
TrickBot began in late 2016 as a financial trojan and a derivative of Dyre before evolving into a broader modular malware platform.
The Dyre banking malware, from which TrickBot later derived, was dismantled in November 2015.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourceadvintel.io
Open sourceadvintel.io
Open sourcefeodotracker.abuse.ch
Open sourcecyberscoop.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcejustice.gov
Open sourcemandiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Cyber Command and Microsoft led parallel efforts to disrupt the **TrickBot** botnet, a major criminal infrastructure used to distribute ransomware and viewed as a potential threat to U.S. election security. Microsoft said it disabled **120 of 128** identified servers through court orders and coordination with hosting providers, ISPs, and international partners, while U.S. officials described a separate military operation intended to temporarily knock the botnet off balance and force its operators to spend time rebuilding rather than launching attacks. Earlier reporting had already shown TrickBot expanding beyond banking malware into large-scale email abuse through its **TrickBooster** module, which harvested credentials and contacts, sent spam from compromised accounts, and was tied to a database containing roughly **250 million** harvested email addresses. The disruption did not eliminate the threat. Incident responders documented a late-2020 intrusion in which TrickBot operators manually deployed malware, used **Cobalt Strike** for privilege escalation and lateral movement, dumped `LSASS` and `NTDS.dit`, and conducted extensive Active Directory reconnaissance consistent with a likely **Ryuk** ransomware attack path. By the end of 2021, reporting indicated that the **Conti** ransomware group had absorbed key TrickBot personnel and become the botnet’s primary user, with plans to shift initial access operations toward **BazarBackdoor**. The FBI also linked **Diavol** ransomware to the TrickBot group, underscoring how the operation persisted after takedowns and continued to serve as a core access and development hub for multiple ransomware campaigns.
Aug 15, 2026
Trickbot recovered from a major 2020 disruption campaign and continued operating as a modular malware platform tied to credential theft, lateral movement, brute forcing, proxying, and ransomware delivery. Microsoft said its court-backed operation with hosting providers, ISPs, and industry partners disabled **120 of 128** identified Trickbot servers, including most core infrastructure, while the remaining systems included compromised IoT devices used for command-and-control. Despite that action, operators rapidly worked to restore infrastructure, and later reporting described Trickbot activity in **149 countries**, with more than **140,000** observed victims and **223 campaigns** over six months. Researchers said the botnet evolved well beyond its banking Trojan origins into a flexible post-compromise framework linked to **Ryuk**, **Conti**, **BazarBackdoor**, and **Anchor**, with modules for Active Directory theft, browser interception, spam propagation, network scanning, RDP and OWA brute forcing, SQL discovery, and worm-like spread using **EternalBlue** and **EternalRomance**. In late 2021, Trickbot also began distributing **Emotet** again, helping drive the malware’s return after its takedown; observed infection chains used password-protected ZIP archives and malicious Excel files that launched PowerShell to download payloads into `C:\ProgramData`, underscoring the botnet’s continued role as a high-risk loader for follow-on malware and ransomware.
Aug 14, 2026
Microsoft said it obtained a court order and worked with telecommunications providers and cybersecurity partners to disrupt the **Trickbot** botnet, a major malware platform used to steal credentials and deliver follow-on threats including ransomware. The action targeted Trickbot's command-and-control infrastructure and supporting services, with Microsoft using legal measures including trademark claims to seize or disable servers and cut communications between infected devices and operators. Reporting tied the operation to concerns that Trickbot could be used to support disruptive cyber activity against U.S. election-related networks, while security researchers noted that separate technical attacks had also been launched against the botnet's backend systems before the legal takedown. The combined effort was described as a significant but likely temporary setback for the criminal group, because Trickbot's operators had shown the ability to rebuild infrastructure and restore portions of the network after prior disruptions.
Jun 29, 2026