Loading story…
IBM X-Force analysis of an older Diavol ransomware sample found stronger technical ties to the TrickBot gang, adding weight to long-standing suspicions that the malware was developed by or closely associated with the same operators. Researchers said a development-stage sample submitted to VirusTotal in January 2021, with a reported March 2020 compilation date, used a Bot ID format that closely matched TrickBot and resembled Anchor DNS, another tool linked to the group.
The sample also showed Russian-language HTTP header preferences and code apparently designed to avoid infecting systems in Russia and CIS countries, patterns that align with previous TrickBot-linked activity. IBM said the evidence stops short of definitive attribution, but the findings reinforce earlier reporting that Diavol shares behavioral similarities with Conti and appears to have evolved from an earlier development build into a later, fully weaponized ransomware variant.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Walmart Global Tech published analysis of a resurfacing of Diavol ransomware after an uptick in newer samples submitted to VirusTotal. The report detailed a 64-bit variant using hybrid XOR and RSA file encryption, identified the WARNING.txt ransom note and .bully extension, and published related IOCs.
Walmart Global Tech researchers identified Diavol-related infrastructure linking enigma-hq[.]net to diavol-news[.]net, with HTML referencing both a Tor mirror and a web mirror. The analysis described the site as a Diavol test leak site, providing new visibility into the group’s public-facing infrastructure.
Kryptos Logic reported that since June 2021, TrickBot has been deploying a revamped banking webinject module to infected systems. The module used Zeus-style webinject techniques and shared substantial code with IcedID's webinject component, indicating renewed bank-fraud activity.
The article states that the Diavol sample previously analyzed by Fortinet had a compilation date of April 30, 2021, representing a later and more weaponized variant than IBM's sample.
The Diavol sample later analyzed by IBM X-Force was submitted to VirusTotal on January 27, 2021.
IBM X-Force's later analysis said the older Diavol sample it examined had a reported compilation date of March 5, 2020, indicating an early development-stage version of the ransomware.
IBM X-Force published research reporting stronger technical links between Diavol ransomware and the TrickBot gang, including near-identical Bot ID formatting and other behavioral overlaps, while stopping short of definitive attribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
securityintelligence.com
Open sourcemedium.com
Open sourcemedium.com
Open sourcechuongdong.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Cyber Command and Microsoft led parallel efforts to disrupt the **TrickBot** botnet, a major criminal infrastructure used to distribute ransomware and viewed as a potential threat to U.S. election security. Microsoft said it disabled **120 of 128** identified servers through court orders and coordination with hosting providers, ISPs, and international partners, while U.S. officials described a separate military operation intended to temporarily knock the botnet off balance and force its operators to spend time rebuilding rather than launching attacks. Earlier reporting had already shown TrickBot expanding beyond banking malware into large-scale email abuse through its **TrickBooster** module, which harvested credentials and contacts, sent spam from compromised accounts, and was tied to a database containing roughly **250 million** harvested email addresses. The disruption did not eliminate the threat. Incident responders documented a late-2020 intrusion in which TrickBot operators manually deployed malware, used **Cobalt Strike** for privilege escalation and lateral movement, dumped `LSASS` and `NTDS.dit`, and conducted extensive Active Directory reconnaissance consistent with a likely **Ryuk** ransomware attack path. By the end of 2021, reporting indicated that the **Conti** ransomware group had absorbed key TrickBot personnel and become the botnet’s primary user, with plans to shift initial access operations toward **BazarBackdoor**. The FBI also linked **Diavol** ransomware to the TrickBot group, underscoring how the operation persisted after takedowns and continued to serve as a core access and development hub for multiple ransomware campaigns.
Aug 15, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into `%AppData%\Roaming`, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an **XMRig** Monero miner alongside its core modules. Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports `443`, `447`, and `449`, HTTP exfiltration on port `8082`, and disguised payload retrieval through `.png` URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for **Cobalt Strike** and ransomware including **Ryuk** and **Conti**. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver **Emotet** and **Qbot**, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Aug 15, 2026