Loading story…
Kaspersky researchers reported that the public release of the NukeBot banking trojan source code led to a wave of derivative malware samples, but only a small fraction were fully operational. Analysis of multiple compiled samples found that many were unfinished or misconfigured, often pointing to localhost or private-network command-and-control addresses, while a smaller set connected to live infrastructure and could be used in real attacks.
By emulating bot-to-C2 communications, the researchers recovered web inject configurations showing that active NukeBot deployments primarily targeted banks in France and the United States. The investigation also uncovered modified variants that dropped the trojan’s web-injection capability and instead focused on credential theft, downloading password-recovery tools from malicious servers to steal browser and email client credentials, underscoring how leaked malware code can enable lower-skill actors while still producing a subset of credible financial threats.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Kaspersky analyzed Jimmy, a new modular Trojan-banker/downloader delivered by a modified NeutrinoPOS malware family, and noted strong code overlap with the publicly available NukeBot source code. The malware shifted away from POS card theft to downloading modules for web injects and Monero mining.
Researchers also identified modified NukeBot variants that lacked web injection functionality and instead stole browser and mail client passwords. These variants were delivered inside droppers that downloaded credential-recovery utilities such as Email Password Recovery from malicious servers.
Researchers later identified several operational or "combat-grade" NukeBot versions. Analysis of the collected injects showed the primary targets were French and U.S. banks, and only about 2% to 5% of obtained samples were assessed as combat-ready.
By imitating bot-to-C2 interaction, researchers triggered NukeBot servers to send web injects and collected inject data from many servers. Most botnets initially served only test injects that matched examples included in the published source code.
After the source code became public, researchers obtained multiple compiled NukeBot samples. Most were non-operational test builds using localhost or local subnet command-and-control addresses, while a smaller subset used real C2 infrastructure.
The author of the NukeBot banking Trojan published its source code in the spring, reportedly to restore his reputation on hacker forums after being suspected of scamming. This release triggered subsequent analysis of compiled samples and later operational use by others.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
arbornetworks.com
Open sourcesecurelist.com
Open sourcesecurelist.com
Open sourcekrebsonsecurity.com
Open sourcesecurityintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into `%AppData%\Roaming`, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an **XMRig** Monero miner alongside its core modules. Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports `443`, `447`, and `449`, HTTP exfiltration on port `8082`, and disguised payload retrieval through `.png` URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for **Cobalt Strike** and ransomware including **Ryuk** and **Conti**. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver **Emotet** and **Qbot**, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Aug 15, 2026
Researchers reported that **DanaBot**, long tracked as a banking Trojan, expanded its operations with new modules and delivery tactics that turned infected systems into platforms for broader criminal activity. ESET found the malware harvesting email addresses from compromised webmail sessions and, on some Open-Xchange services, sending reply-chain spam with malicious ZIP attachments from victims’ own accounts to spread additional payloads. The campaigns, including activity targeting Italy, showed DanaBot moving beyond credential theft and banking fraud into self-propagating spam operations, while infrastructure and payload patterns also suggested cooperation with other malware operators, including possible links to **GootKit**. Check Point later observed DanaBot campaigns delivering a Delphi-based ransomware strain dubbed **NonRansomware** through its modular command-and-control framework. In one European campaign, a `crypt` module fetched from `95.179.186.57` encrypted files with a `.non` extension, dropped **HowToBackFiles.txt** ransom notes, disabled defenses and recovery mechanisms, and created persistence with a scheduled task. The DanaBot platform itself was described as actively maintained, with updated plugins, revised string encryption and filename generation, and newer **AES256/RSA**-based C2 communications, underscoring its evolution from a banking Trojan into a multi-purpose malware service capable of spam distribution, payload delivery, and ransomware deployment.
Aug 14, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026