Loading story…
TrickBot emerged as a banking trojan linked to post-Dyre criminal activity and was initially distributed through spam campaigns that installed intermediary loaders before fetching the malware from command-and-control infrastructure. Over time, operators expanded delivery methods to include malicious links, macro-enabled Word documents, ZIP archives with shortcut files, and phishing chains involving loaders such as Smoke Loader and Godzilla Loader. Researchers documented TrickBot copying itself into %AppData%\Roaming, using download-and-execute tasking, stealing browser passwords, form data, banking information, and system details, and in at least one case deploying an XMRig Monero miner alongside its core modules.
Network and intrusion analysis showed TrickBot using distinctive HTTPS/TLS command-and-control traffic on ports 443, 447, and 449, HTTP exfiltration on port 8082, and disguised payload retrieval through .png URLs that actually served Windows executables. The malware was also observed moving laterally in Active Directory environments via an EternalBlue-based SMB exploit and frequently serving as an initial access platform for Cobalt Strike and ransomware including Ryuk and Conti. By 2021 and early 2022, researchers reported a shift in the ecosystem as TrickBot was used to deliver Emotet and Qbot, while fresh TrickBot campaigns declined, suggesting operators were monetizing remaining infections and transitioning toward newer malware platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
The Hacker News reports that no new TrickBot activity had been recorded since the start of 2022, indicating campaigns had largely stalled. Researchers assessed that the malware was likely being phased out in favor of other platforms, even as some C2 infrastructure remained active.
The last set of attacks involving TrickBot was registered on December 28, 2021, according to the report cited by The Hacker News. The article uses this as the last dated campaign activity before the subsequent lull.
Intel 471 observed TrickBot delivering Qbot to compromised systems shortly after Emotet returned in November 2021. The report said this suggested a behind-the-scenes shake-up or migration toward other malware platforms.
The Hacker News reports that attacks first observed in November 2021 used TrickBot to download and execute Emotet binaries, reversing the earlier relationship where Emotet often dropped TrickBot. Intel 471 cited this as evidence of a major operational shift.
The TA551-related TrickBot download pattern changed from "/bdfh/" to "/bmdff/" around mid-August 2021, according to the malware analysis. This reflects an operational change in the delivery infrastructure.
The Hacker News says TA551 began delivering TrickBot in phishing campaigns starting in June 2021 using encrypted ZIP attachments containing macro-enabled documents. Those documents dropped HTA files, downloaded TrickBot DLLs, and executed them via regsvr32.exe.
A Malware-Traffic-Analysis examination of a TrickBot infection chain on 2018-02-01 found behavior similar to prior TrickBot activity but with an added Monero cryptocurrency mining component identified as XMRig. The infection chain ran from email to malicious link to Word document to macro execution to Smoke Loader to TrickBot.
Unit 42 states that TrickBot had been infecting victims since 2016. This marks the start of the malware family's observed activity in the source material.
The NETSCOUT ASERT report says TrickBot emerged after the November 2015 takedown of Dyreza/Dyre infrastructure, which had previously been tied to arrests by Russian authorities. The report presents this as the backdrop for early TrickBot activity.
The ASERT report says early TrickBot activity involved limited initial targeting, including a small number of Australian banks. It presents this as a characteristic of the malware's early operations.
ASERT describes an early spam campaign using the subject "You have received a new fax" and a malicious attachment, fax198-203-9153.scr, which installed Godzilla Loader. Godzilla Loader then downloaded TrickBot from 185.14.29[.]13/api.php.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
arbornetworks.com
Open sourcemalware-traffic-analysis.net
Open sourcethehackernews.com
Open sourcethehackernews.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
Trickbot recovered from a major 2020 disruption campaign and continued operating as a modular malware platform tied to credential theft, lateral movement, brute forcing, proxying, and ransomware delivery. Microsoft said its court-backed operation with hosting providers, ISPs, and industry partners disabled **120 of 128** identified Trickbot servers, including most core infrastructure, while the remaining systems included compromised IoT devices used for command-and-control. Despite that action, operators rapidly worked to restore infrastructure, and later reporting described Trickbot activity in **149 countries**, with more than **140,000** observed victims and **223 campaigns** over six months. Researchers said the botnet evolved well beyond its banking Trojan origins into a flexible post-compromise framework linked to **Ryuk**, **Conti**, **BazarBackdoor**, and **Anchor**, with modules for Active Directory theft, browser interception, spam propagation, network scanning, RDP and OWA brute forcing, SQL discovery, and worm-like spread using **EternalBlue** and **EternalRomance**. In late 2021, Trickbot also began distributing **Emotet** again, helping drive the malware’s return after its takedown; observed infection chains used password-protected ZIP archives and malicious Excel files that launched PowerShell to download payloads into `C:\ProgramData`, underscoring the botnet’s continued role as a high-risk loader for follow-on malware and ransomware.
Aug 14, 2026
Researchers and government agencies reported that **TrickBot** continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including **Ryuk** and **Conti** ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected `.docm` files used an `AutoOpen` macro to extract hidden VBScript, write a `.VBE` file to `C:\ProgramData`, rebuild a TrickBot DLL, decode it with `certutil`, and execute it through `regsvr32.exe`, helping the malware evade static and behavioral detection. TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older **`mworm`** propagation module with **`nworm`**, which fetched an encrypted payload over HTTP and executed it **in memory** on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with **MikroTik** routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific **gtag** identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of **`CVE-2017-0144`**, and phishing-driven execution chains that lead to TrickBot installation.
Aug 15, 2026