Check Point Research (CPR) has discovered new and sophisticated details of the implementation of Trickbot. A well-known banking Trojan, Trickbot steals and compromises the data of its victims, targeting high-profile victims. CPR counts over 140,000 machines infected by Trickbot since November 2020, many of which are customers of well-known corporations, such as Amazon, Microsoft, Google, and PayPal. In total, CPR documented 60 corporations whose customers have fallen victim to Trickbot throughout the past 14 months.
Key Implementation Details of Trickbot
- Malware is very selective in how it chooses its targets
- Various tricks – including anti-analysis and anti-Deobfuscation – implemented inside the modules show the authors’ highly technical background
- Trickbots infrastructure can be utilized by various malware families to cause more damage on infected machines
- Sophisticated and versatile malware with more than 20 modules that can be downloaded and executed on demand
How Trickbot Works:
- Threat actors receive a database of stolen emails and send malicious documents to the chosen addresses
- The user downloads and opens such a document, allowing macro execution in the process
- The first stage of malware is executed, and the main Trickbot payload is downloaded
- The main Trickbot payload is executed and establishes its persistence on the infected machine.
- Auxiliary Trickbot modules can be uploaded to the infected machine on demand by the threat actors, the functionality of such modules may vary: it may be spreading via compromised corporate network, stealing corporate credentials, grabbing login details to banking sites, etc.
Scope of Impact
Below is a table that shows the percentage of organizations affected by Trickbot in each region:
|World||1 of every 45||2.2%|
|APAC||1 of every 30||3.3%|
|Latin America||1 of every 47||2.1%|
|Europe||1 of every 54||1.9%|
|Africa||1 of every 57||1.8%|
|North America||1 of every 69||1.4%|
Alexander Chailytko, Cyber Security, Research & Innovation Manager at Check Point Software Technologies, says “Trickbot’s numbers have been staggering. We’ve documented over 140,000 machines targeting the customers of some of the biggest and most reputable companies in the world. We went on to observe that the Trickbot authors have the skills to approach malware development from a very low level and pay attention to small details.”
He continues. “Trickbot attacks high-profile victims to steal the credentials and provide its operators access to the portals with sensitive data where they can cause even more damage. At the same time, we know that the operators behind the infrastructure are very experienced with malware development on a high level as well. The combination of these two factors is what allows Trickbot to remain a dangerous threat for more than five years already. I strongly urge people to only open documents from trusted sources and to use different passwords on different websites.”
- Only open documents you receive from trusted sources.
- Do not enable macro execution inside the documents.
- Make sure you have the latest operating system and anti-virus updates up and running.
- Use different passwords on different websites.
The list of targeted companies
|AmericanExpress||Credit Card Service|
|AOL||Online service provider|
|Associated Banc-Corp||Bank Holding|
|Bank of Montreal||Investment Banking|
|Barclays Bank Delaware||Bank|
|Blockchain.com||Cryptocurrency Financial Services|
|Canadian Imperial Bank of Commerce||Financial Services|
|Capital One||Bank Holding|
|Card Center Direct||Digital Banking|
|Centennial Bank||Bank Holding|
|Citizens Financial Group||Bank|
|Desjardins Group||Financial Services|
|FundsXpress||IT Service Management|
|HawaiiUSA Federal Credit Union||Credit Union|
|Huntington Bancshares||Bank Holding|
|Huntington Bank||Bank Holding|
|Interactive Brokers||Financial Services|
|JPMorgan Chase||Investment Banking|
|Navy Federal||Credit Union|
|Royal Bank of Canada||Financial Services|
|SunTrust Bank||Bank Holding|
|T. Rowe Price||Investment Management|
|TD Commercial Banking||Financial Services|
|Truist Financial||Bank Holding|
|U.S. Bancorp||Bank Holding|
|Wells Fargo||Financial Services|
|ZoomInfo||Software as a service|