| SYMBOL | COMMON_NAME | aka. SYNONYMS |
win.trickbot (Back to overview)
TrickBot
aka: Trickster, TheTrick, TrickLoader
Actor(s): TA505, UNC1878, WIZARD SPIDER
A financial Trojan believed to be a derivative of Dyre: the bot uses very similar code, web injects, and operational tactics. Has multiple modules including VNC and Socks5 Proxy. Uses SSL for C2 communication.
- Q4 2016 - Detected in wild
Oct 2016 - 1st Report
2017 - Trickbot primarily uses Necurs as vehicle for installs.
Jan 2018 - Use XMRIG (Monero) miner
Feb 2018 - Theft Bitcoin
Mar 2018 - Unfinished ransomware module
Q3/4 2018 - Trickbot starts being spread through Emotet.
Infection Vector
1. Phish > Link MS Office > Macro Enabled > Downloader > Trickbot
2. Phish > Attached MS Office > Macro Enabled > Downloader > Trickbot
3. Phish > Attached MS Office > Macro enabled > Trickbot installed
References
| 2023-02-09 ⋅ U.S. Department of the Treasury ⋅ United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang TrickBot |
| 2023-01-30 ⋅ Checkpoint ⋅ Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware Agent Tesla Azorult Buer Cerber Cobalt Strike Emotet Formbook HawkEye Keylogger Loki Password Stealer (PWS) Maze NetWire RC Remcos REvil TrickBot |
| 2022-12-27 ⋅ Palo Alto Networks Unit 42 ⋅ Navigating the Vast Ocean of Sandbox Evasions TrickBot Zebrocy |
| 2022-10-31 ⋅ paloalto Netoworks: Unit42 ⋅ Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure Dridex Kronos TrickBot Zeus |
| 2022-09-13 ⋅ AdvIntel ⋅ AdvIntel's State of Emotet aka "SpmTools" Displays Over Million Compromised Machines Through 2022 Conti Cobalt Strike Emotet Ryuk TrickBot |
| 2022-08-18 ⋅ IBM ⋅ From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers BumbleBee Karius Ramnit TrickBot Vawtrak |
| 2022-08-15 ⋅ SentinelOne ⋅ Detecting a Rogue Domain Controller – DCShadow Attack MimiKatz TrickBot |
| 2022-06-15 ⋅ AttackIQ ⋅ Attack Graph Emulating the Conti Ransomware Team’s Behaviors BazarBackdoor Conti TrickBot |
| 2022-06-02 ⋅ Eclypsium ⋅ Conti Targets Critical Firmware Conti HermeticWiper TrickBot WhisperGate |
| 2022-05-24 ⋅ The Hacker News ⋅ Malware Analysis: Trickbot Cobalt Strike Conti Ryuk TrickBot |
| 2022-05-17 ⋅ Trend Micro ⋅ Ransomware Spotlight: RansomEXX LaZagne Cobalt Strike IcedID MimiKatz PyXie RansomEXX TrickBot |
| 2022-05-09 ⋅ Microsoft ⋅ Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT |
| 2022-05-09 ⋅ Microsoft Security ⋅ Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself Griffon BazarBackdoor BlackCat BlackMatter Blister Gozi LockBit Pandora Rook SystemBC TrickBot |
| 2022-05-05 ⋅ YouTube (Chris Greer) ⋅ MALWARE Analysis with Wireshark // TRICKBOT Infection TrickBot |
| 2022-04-28 ⋅ Symantec ⋅ Ransomware: How Attackers are Breaching Corporate Networks AvosLocker Conti Emotet Hive IcedID PhotoLoader QakBot TrickBot |
| 2022-04-27 ⋅ Medium elis531989 ⋅ The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection BumbleBee TrickBot |
| 2022-04-26 ⋅ Intel 471 ⋅ Conti and Emotet: A constantly destructive duo Cobalt Strike Conti Emotet IcedID QakBot TrickBot |
| 2022-04-20 ⋅ CISA ⋅ Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet |
| 2022-04-20 ⋅ CISA ⋅ AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader |
| 2022-04-18 ⋅ RiskIQ ⋅ RiskIQ: Trickbot Rickroll TrickBot |
| 2022-04-17 ⋅ BushidoToken Blog ⋅ Lessons from the Conti Leaks BazarBackdoor Conti Emotet IcedID Ryuk TrickBot |
| 2022-04-15 ⋅ Arctic Wolf ⋅ The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model Conti Diavol Ryuk TrickBot |
| 2022-04-15 ⋅ Bleeping Computer ⋅ Karakurt revealed as data extortion arm of Conti cybercrime syndicate Anchor BazarBackdoor Conti TrickBot |
| 2022-04-08 ⋅ ReversingLabs ⋅ ConversingLabs Ep. 2: Conti pivots as ransomware as a service struggles Conti Emotet TrickBot |
| 2022-04-05 ⋅ Intel 471 ⋅ Move fast and commit crimes: Conti’s development teams mirror corporate tech BazarBackdoor TrickBot |
| 2022-03-31 ⋅ Trellix ⋅ Conti Leaks: Examining the Panama Papers of Ransomware LockBit Amadey Buer Conti IcedID LockBit Mailto Maze PhotoLoader Ryuk TrickBot |
| 2022-03-23 ⋅ Secureworks ⋅ Threat Intelligence Executive Report Volume 2022, Number 2 Conti Emotet IcedID TrickBot |
| 2022-03-23 ⋅ Secureworks ⋅ GOLD ULRICK Leaks Reveal Organizational Structure and Relationships Conti Emotet IcedID TrickBot |
| 2022-03-21 ⋅ Threat Post ⋅ Conti Ransomware V. 3, Including Decryptor, Leaked Cobalt Strike Conti TrickBot |
| 2022-03-18 ⋅ Avast ⋅ Mēris and TrickBot standing on the shoulders of giants Glupteba Proxy Glupteba TrickBot |
| 2022-03-16 ⋅ Microsoft ⋅ Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure TrickBot |
| 2022-03-15 ⋅ RiskIQ ⋅ RiskIQ: Trickbot Abuse of Compromised MikroTik Routers for Command and Control TrickBot |
| 2022-03-09 ⋅ Bleeping Computer ⋅ CISA updates Conti ransomware alert with nearly 100 domain names BazarBackdoor Cobalt Strike Conti TrickBot |
| 2022-03-09 ⋅ BreachQuest ⋅ The Conti Leaks | Insight into a Ransomware Unicorn Cobalt Strike MimiKatz TrickBot |
| 2022-03-04 ⋅ Reuters ⋅ Details of another big ransomware group 'Trickbot' leak online, experts say TrickBot |
| 2022-03-02 ⋅ CyberArk ⋅ Conti Group Leaked! TeamTNT Conti TrickBot |
| 2022-03-02 ⋅ KrebsOnSecurity ⋅ Conti Ransomware Group Diaries, Part II: The Office Conti Emotet Ryuk TrickBot |
| 2022-03-02 ⋅ Threatpost ⋅ Conti Ransomware Decryptor, TrickBot Source Code Leaked Conti TrickBot |
| 2022-03-01 ⋅ Leaks: Conti / Trickbot Conti TrickBot |
| 2022-02-25 ⋅ CyberScoop ⋅ TrickBot malware suddenly got quiet, researchers say, but it's hardly the end for its operators BazarBackdoor Emotet TrickBot |
| 2022-02-24 ⋅ The Hacker News ⋅ TrickBot Gang Likely Shifting Operations to Switch to New Malware BazarBackdoor Emotet QakBot TrickBot |
| 2022-02-24 ⋅ The Record ⋅ TrickBot gang shuts down botnet after months of inactivity TrickBot |
| 2022-02-24 ⋅ The Hacker News ⋅ Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure BazarBackdoor Emotet TrickBot |
| 2022-02-22 ⋅ Bankinfo Security ⋅ Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware Conti TrickBot |
| 2022-02-20 ⋅ Security Affairs ⋅ The Conti ransomware group takes over TrickBot malware operation and plans to replace it with BazarBackdoor malware. Conti TrickBot |
| 2022-02-18 ⋅ Bleeping Computer ⋅ Conti ransomware gang takes over TrickBot malware operation Conti TrickBot |
| 2022-02-16 ⋅ Check Point Research ⋅ A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies TrickBot |
| 2022-02-16 ⋅ Threat Post ⋅ TrickBot Ravages Customers of Amazon, PayPal and Other Top Brands TrickBot |
| 2022-02-16 ⋅ Advanced Intelligence ⋅ The TrickBot Saga’s Finale Has Aired: Spinoff is Already in the Works TrickBot |
| 2022-02-08 ⋅ Intel 471 ⋅ PrivateLoader: The first step in many malware schemes Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar |
| 2022-02-02 ⋅ IBM ⋅ TrickBot Gang Uses Template-Based Metaprogramming in Bazar Malware BazarBackdoor TrickBot |
| 2022-02-01 ⋅ Wired ⋅ Inside Trickbot, Russia’s Notorious Ransomware Gang TrickBot |
| 2022-02-01 ⋅ Wired ⋅ Inside Trickbot, Russia’s Notorious Ransomware Gang TrickBot |
| 2022-01-24 ⋅ IBM ⋅ TrickBot Bolsters Layered Defenses to Prevent Injection Research TrickBot |
| 2022-01-24 ⋅ Kryptos Logic ⋅ Deep Dive into Trickbot's Web Injection TrickBot |
| 2022-01-19 ⋅ FBI ⋅ CU-000161-MW: Indicators of Compromise Associated with Diavol Ransomware Diavol TrickBot |
| 2022-01-18 ⋅ Recorded Future ⋅ 2021 Adversary Infrastructure Report BazarBackdoor Cobalt Strike Dridex IcedID QakBot TrickBot |
| 2021-12-08 ⋅ Check Point Research ⋅ When old friends meet again: why Emotet chose Trickbot for rebirth Emotet TrickBot |
| 2021-12-03 ⋅ GoSecure ⋅ TrickBot Leverages Zoom Work from Home Interview Malspam, Heaven’s Gate and… Spamhaus? TrickBot |
| 2021-11-16 ⋅ Malwarebytes ⋅ TrickBot helps Emotet come back from the dead Emotet TrickBot |
| 2021-11-12 ⋅ Recorded Future ⋅ The Business of Fraud: Botnet Malware Dissemination Mozi Dridex IcedID QakBot TrickBot |
| 2021-10-29 ⋅ Europol ⋅ 12 targeted for involvement in ransomware attacks against critical infrastructure Cobalt Strike Dharma LockerGoga MegaCortex TrickBot |
| 2021-10-29 ⋅ Національна поліція України ⋅ Cyberpolice exposes transnational criminal group in causing $ 120 million in damage to foreign companies Cobalt Strike Dharma LockerGoga MegaCortex TrickBot |
| 2021-10-28 ⋅ Department of Justice ⋅ Indictment: Russian National (Vladimir Dunaev) Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization TrickBot |
| 2021-10-28 ⋅ Department of Justice ⋅ Russian National (Vladimir Dunaev) Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization TrickBot |
| 2021-10-27 ⋅ VinCSS ⋅ [RE025] TrickBot ... many tricks TrickBot |
| 2021-10-19 ⋅ Kaspersky ⋅ Trickbot module descriptions TrickBot |
| 2021-10-13 ⋅ IBM ⋅ Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds BazarBackdoor TrickBot |
| 2021-10-08 ⋅ Zscaler ⋅ New Trickbot and BazarLoader campaigns use multiple delivery vectorsi BazarBackdoor TrickBot |
| 2021-10-07 ⋅ Mandiant ⋅ FIN12 Group Profile: FIN12 Priotizes Speed to Deploy Ransomware Aginst High-Value Targets Cobalt Strike Empire Downloader TrickBot |
| 2021-10-04 ⋅ Cisco ⋅ Threat hunting in large datasets by clustering security events BazarBackdoor TrickBot |
| 2021-10 ⋅ HP ⋅ Threat Insights Report Q3 - 2021 STRRAT CloudEyE NetWire RC Remcos TrickBot Vjw0rm |
| 2021-09-06 ⋅ Bleeping Computer ⋅ TrickBot gang developer arrested when trying to leave Korea Diavol TrickBot |
| 2021-09-03 ⋅ Trend Micro ⋅ The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader |
| 2021-08-15 ⋅ Symantec ⋅ The Ransomware Threat Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker |
| 2021-08-01 ⋅ The DFIR Report ⋅ BazarCall to Conti Ransomware via Trickbot and Cobalt Strike BazarBackdoor Cobalt Strike Conti TrickBot |
| 2021-07-21 ⋅ splunk ⋅ Detecting Trickbot with Splunk TrickBot |
| 2021-07-12 ⋅ Bitdefender ⋅ A Fresh Look at Trickbot’s Ever-Improving VNC Module TrickBot |
| 2021-07-02 ⋅ The Record ⋅ TrickBot: New attacks see the botnet deploy new banking module, new ransomware TrickBot |
| 2021-07-01 ⋅ Kryptos Logic ⋅ TrickBot and Zeus TrickBot Zeus |
| 2021-06-16 ⋅ Proofpoint ⋅ The First Step: Initial Access Leads to Ransomware BazarBackdoor Egregor IcedID Maze QakBot REvil Ryuk TrickBot WastedLocker |
| 2021-06-07 ⋅ Medium walmartglobaltech ⋅ Inside the SystemBC Malware-As-A-Service Ryuk SystemBC TrickBot |
| 2021-06-04 ⋅ Department of Justice ⋅ Latvian National Charged for Alleged Role in Transnational Cybercrime Organization TrickBot |
| 2021-06-04 ⋅ The Record ⋅ US arrests Latvian woman who worked on Trickbot malware source code TrickBot |
| 2021-05-19 ⋅ Intel 471 ⋅ Look how many cybercriminals love Cobalt Strike BazarBackdoor Cobalt Strike Hancitor QakBot SmokeLoader SystemBC TrickBot |
| 2021-05-11 ⋅ Mal-Eats ⋅ Campo, a New Attack Campaign Targeting Japan AnchorDNS BazarBackdoor campoloader Cobalt Strike Phobos Snifula TrickBot Zloader |
| 2021-05-10 ⋅ Mal-Eats ⋅ Overview of Campo, a new attack campaign targeting Japan AnchorDNS BazarBackdoor Cobalt Strike ISFB Phobos TrickBot Zloader |
| 2021-05-05 ⋅ RiskIQ ⋅ Viruses to Violations - TrickBot's Shift in Tactics During the Pandemic TrickBot |
| 2021-05-02 ⋅ The DFIR Report ⋅ Trickbot Brief: Creds and Beacons Cobalt Strike TrickBot |
| 2021-04-15 ⋅ Proofpoint ⋅ Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes Dridex TrickBot |
| 2021-04-06 ⋅ Intel 471 ⋅ EtterSilent: the underground’s new favorite maldoc builder BazarBackdoor ISFB QakBot TrickBot |
| 2021-04-05 ⋅ Medium walmartglobaltech ⋅ TrickBot Crews New CobaltStrike Loader Cobalt Strike TrickBot |
| 2021-03-31 ⋅ Red Canary ⋅ 2021 Threat Detection Report Shlayer Andromeda Cobalt Strike Dridex Emotet IcedID MimiKatz QakBot TrickBot |
| 2021-03-31 ⋅ Kaspersky ⋅ Financial Cyberthreats in 2020 BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus |
| 2021-03-21 ⋅ Blackberry ⋅ 2021 Threat Report Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot |
| 2021-03-17 ⋅ CISA ⋅ Alert (AA21-076A): TrickBot Malware TrickBot |
| 2021-03 ⋅ Group-IB ⋅ Ransomware Uncovered 2020/2021 RansomEXX BazarBackdoor Buer Clop Conti DoppelPaymer Dridex Egregor IcedID Maze PwndLocker QakBot RansomEXX REvil Ryuk SDBbot TrickBot Zloader |
| 2021-02-28 ⋅ PWC UK ⋅ Cyber Threats 2020: A Year in Retrospect elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Tonto Team |
| 2021-02-25 ⋅ ANSSI ⋅ Ryuk Ransomware BazarBackdoor Buer Conti Emotet Ryuk TrickBot |
| 2021-02-24 ⋅ IBM ⋅ X-Force Threat Intelligence Index 2021 Emotet QakBot Ramnit REvil TrickBot |
| 2021-02-23 ⋅ CrowdStrike ⋅ 2021 Global Threat Report RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER |
| 2021-02-08 ⋅ ESET Research ⋅ THREAT REPORT Q4 2020 TrickBot |
| 2021-02-02 ⋅ CRONUP ⋅ De ataque con Malware a incidente de Ransomware Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader |
| 2021-02-01 ⋅ Kryptos Logic ⋅ Trickbot masrv Module TrickBot |
| 2021-02-01 ⋅ Microsoft ⋅ What tracking an attacker email infrastructure tells us about persistent cybercriminal operations Dridex Emotet Makop Ransomware SmokeLoader TrickBot |
| 2021-01-28 ⋅ Youtube (Virus Bulletin) ⋅ The Bagsu banker case Azorult DreamBot Emotet Pony TrickBot ZeusAction |
| 2021-01-26 ⋅ IBM ⋅ TrickBot’s Survival Instinct Prevails — What’s Different About the TrickBoot Version? TrickBot |
| 2021-01-20 ⋅ Medium walmartglobaltech ⋅ Anchor and Lazarus together again? Anchor TrickBot |
| 2021-01-19 ⋅ Palo Alto Networks Unit 42 ⋅ Wireshark Tutorial: Examining Emotet Infection Traffic Emotet GootKit IcedID QakBot TrickBot |
| 2021-01-11 ⋅ The DFIR Report ⋅ Trickbot Still Alive and Well Cobalt Strike TrickBot |
| 2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Command and Control Traffic Patterns ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot |
| 2021-01-06 ⋅ DomainTools ⋅ Holiday Bazar: Tracking a TrickBot-Related Ransomware Incident BazarBackdoor TrickBot |
| 2021-01-04 ⋅ SentinelOne ⋅ Building a Custom Malware Analysis Lab Environment TrickBot |
| 2021 ⋅ Secureworks ⋅ Threat Profile: GOLD BLACKBURN Buer Dyre TrickBot WIZARD SPIDER |
| 2020-12-21 ⋅ KEYSIGHT TECHNOLOGIES ⋅ TrickBot: A Closer Look TrickBot |
| 2020-12-10 ⋅ Cybereason ⋅ Cybereason vs. Ryuk Ransomware BazarBackdoor Ryuk TrickBot |
| 2020-12-10 ⋅ CyberInt ⋅ Ryuk Crypto-Ransomware Ryuk TrickBot |
| 2020-12-03 ⋅ Eclypsium ⋅ TrickBot Now Offers ‘TrickBoot’: Persist, Brick, Profit TrickBot |
| 2020-11-23 ⋅ Bitdefender ⋅ TrickBot is Dead. Long Live TrickBot! TrickBot |
| 2020-11-22 ⋅ malware.love ⋅ Trickbot tricks again [UPDATE] TrickBot |
| 2020-11-20 ⋅ Bleeping Computer ⋅ LightBot: TrickBot’s new reconnaissance malware for high-value targets LightBot TrickBot |
| 2020-11-20 ⋅ ZDNet ⋅ The malware that usually installs ransomware and you need to remove right away Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader |
| 2020-11-18 ⋅ Sophos ⋅ SOPHOS 2021 THREAT REPORT Navigating cybersecurity in an uncertain world Agent Tesla Dridex TrickBot Zloader |
| 2020-11-17 ⋅ Twitter (@VK_intel) ⋅ Tweet on a new fileless TrickBot loading method using code from MemoryModule TrickBot |
| 2020-11-17 ⋅ malware.love ⋅ Trickbot tricks again TrickBot |
| 2020-11-17 ⋅ Salesforce Engineering ⋅ Easily Identify Malicious Servers on the Internet with JARM Cobalt Strike TrickBot |
| 2020-11-12 ⋅ Hurricane Labs ⋅ Splunking with Sysmon Part 4: Detecting Trickbot TrickBot |
| 2020-11-10 ⋅ Intel 471 ⋅ Trickbot down, but is it out? BazarBackdoor TrickBot |
| 2020-11-04 ⋅ VMRay ⋅ Trick or Threat: Ryuk ransomware targets the health care industry BazarBackdoor Cobalt Strike Ryuk TrickBot |
| 2020-10-29 ⋅ Palo Alto Networks Unit 42 ⋅ Threat Assessment: Ryuk Ransomware and Trickbot Targeting U.S. Healthcare and Public Health Sector Anchor BazarBackdoor Ryuk TrickBot |
| 2020-10-29 ⋅ Twitter (@anthomsec) ⋅ Tweet on UNC1878 activity BazarBackdoor Ryuk TrickBot UNC1878 |
| 2020-10-29 ⋅ Red Canary ⋅ A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak Cobalt Strike Ryuk TrickBot |
| 2020-10-26 ⋅ Arbor Networks ⋅ Dropping the Anchor AnchorDNS Anchor TrickBot |
| 2020-10-20 ⋅ Microsoft ⋅ An update on disruption of Trickbot TrickBot |
| 2020-10-20 ⋅ Bundesamt für Sicherheit in der Informationstechnik ⋅ Die Lage der IT-Sicherheit in Deutschland 2020 Clop Emotet REvil Ryuk TrickBot |
| 2020-10-20 ⋅ Intel 471 ⋅ Global Trickbot disruption operation shows promise TrickBot |
| 2020-10-16 ⋅ CrowdStrike ⋅ WIZARD SPIDER Update: Resilient, Reactive and Resolute BazarBackdoor Conti Ryuk TrickBot |
| 2020-10-16 ⋅ Duo ⋅ Trickbot Up to Its Old Tricks TrickBot |
| 2020-10-15 ⋅ Intel 471 ⋅ That was quick: Trickbot is back after disruption attempts TrickBot |
| 2020-10-15 ⋅ Department of Justice ⋅ Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals Dridex ISFB TrickBot |
| 2020-10-12 ⋅ ESET Research ⋅ ESET takes part in global operation to disrupt Trickbot TrickBot |
| 2020-10-12 ⋅ Microsoft ⋅ Trickbot disrupted TrickBot |
| 2020-10-12 ⋅ Lumen ⋅ A Look Inside The TrickBot Botnet TrickBot |
| 2020-10-12 ⋅ Microsoft ⋅ New action to combat ransomware ahead of U.S. elections Ryuk TrickBot |
| 2020-10-12 ⋅ Symantec ⋅ Trickbot: U.S. Court Order Hits Botnet’s Infrastructure Ryuk TrickBot |
| 2020-10-12 ⋅ TRICKBOT complaint TrickBot |
| 2020-10-10 ⋅ The Washington Post ⋅ Cyber Command has sought to disrupt the world’s largest botnet, hoping to reduce its potential impact on the election TrickBot |
| 2020-10-08 ⋅ Bromium ⋅ Droppers, Downloaders and TrickBot: Detecting a Stealthy COVID-19-themed Campaign using Toolmarks TrickBot |
| 2020-10-02 ⋅ KrebsOnSecurity ⋅ Attacks Aimed at Disrupting the Trickbot Botnet TrickBot |
| 2020-10-02 ⋅ Health Sector Cybersecurity Coordination Center (HC3) ⋅ Report 202010021600: Recent Bazarloader Use in Ransomware Campaigns BazarBackdoor Cobalt Strike Ryuk TrickBot |
| 2020-09-29 ⋅ Microsoft ⋅ Microsoft Digital Defense Report Emotet IcedID Mailto Maze QakBot REvil RobinHood TrickBot |
| 2020-09-29 ⋅ PWC UK ⋅ What's behind the increase in ransomware attacks this year? DarkSide Avaddon Clop Conti DoppelPaymer Dridex Emotet FriedEx Mailto PwndLocker QakBot REvil Ryuk SMAUG SunCrypt TrickBot WastedLocker |
| 2020-09-22 ⋅ OSINT Fans ⋅ What Service NSW has to do with Russia? TrickBot |
| 2020-09-16 ⋅ Intel 471 ⋅ Partners in crime: North Koreans and elite Russian-speaking cybercriminals TrickBot |
| 2020-08-31 ⋅ cyber.wtf blog ⋅ Trickbot rdpscanDll – Transforming Candidate Credentials for Brute-Forcing RDP Servers TrickBot |
| 2020-08-20 ⋅ CERT-FR ⋅ Development of the Activity of the TA505 Cybercriminal Group AndroMut Bart Clop Dridex FlawedAmmyy FlawedGrace Get2 Locky Marap QuantLoader SDBbot ServHelper tRat TrickBot |
| 2020-08-09 ⋅ F5 Labs ⋅ Banking Trojans: A Reference Guide to the Malware Family Tree BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus |
| 2020-07-29 ⋅ ESET Research ⋅ THREAT REPORT Q2 2020 DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor |
| 2020-07-22 ⋅ SentinelOne ⋅ Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) ISFB Maze TrickBot Zloader |
| 2020-07-20 ⋅ Bleeping Computer ⋅ Emotet-TrickBot malware duo is back infecting Windows machines Emotet TrickBot |
| 2020-07-13 ⋅ JoeSecurity ⋅ TrickBot's new API-Hammering explained TrickBot |
| 2020-07-11 ⋅ Advanced Intelligence ⋅ TrickBot Group Launches Test Module Alerting on Fraud Activity TrickBot |
| 2020-07-11 ⋅ BleepingComputer ⋅ TrickBot malware mistakenly warns victims that they are infected TrickBot |
| 2020-07-06 ⋅ NTT ⋅ TrickBot variant “Anchor_DNS” communicating over DNS AnchorDNS TrickBot |
| 2020-06-22 ⋅ CERT-FR ⋅ Évolution De Lactivité du Groupe Cybercriminel TA505 Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot |
| 2020-06-22 ⋅ Sentinel LABS ⋅ Inside a TrickBot Cobalt Strike Attack Server Cobalt Strike TrickBot |
| 2020-06-17 ⋅ Youtube (Red Canary) ⋅ ATT&CK® Deep Dive: Process Injection ISFB Ramnit TrickBot |
| 2020-06-15 ⋅ Fortinet ⋅ Global Malicious Spam Campaign Using Black Lives Matter as a Lure TrickBot |
| 2020-06-12 ⋅ Hornetsecurity ⋅ Trickbot Malspam Leveraging Black Lives Matter as Lure TrickBot |
| 2020-06-11 ⋅ Cofense ⋅ All You Need Is Text: Second Wave TrickBot |
| 2020-06-02 ⋅ Lastline Labs ⋅ Evolution of Excel 4.0 Macro Weaponization Agent Tesla DanaBot ISFB TrickBot Zloader |
| 2020-05-28 ⋅ Palo Alto Networks Unit 42 ⋅ Goodbye Mworm, Hello Nworm: TrickBot Updates Propagation Module TrickBot |
| 2020-05-21 ⋅ Intel 471 ⋅ A brief history of TA505 AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot |
| 2020-05-19 ⋅ AlienLabs ⋅ TrickBot BazarLoader In-Depth Anchor BazarBackdoor TrickBot |
| 2020-05-14 ⋅ SentinelOne ⋅ Deep Dive Into TrickBot Executor Module “mexec”: Reversing the Dropper Variant TrickBot |
| 2020-04-14 ⋅ Intrinsec ⋅ Deobfuscating and hunting for OSTAP, Trickbot’s dropper and best friend ostap TrickBot |
| 2020-04-14 ⋅ Intel 471 ⋅ Understanding the relationship between Emotet, Ryuk and TrickBot Emotet Ryuk TrickBot |
| 2020-04-09 ⋅ Zscaler ⋅ TrickBot Emerges with a Few New Tricks TrickBot |
| 2020-04-08 ⋅ SentinelOne ⋅ Deep Dive Into TrickBot Executor Module “mexec”: Hidden “Anchor” Bot Nexus Operations Anchor TrickBot |
| 2020-04-07 ⋅ SecurityIntelligence ⋅ ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework More_eggs Anchor TrickBot |
| 2020-04-01 ⋅ Cisco ⋅ Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors Azorult CloudEyE Formbook KPOT Stealer Metamorfo Nanocore RAT NetWire RC TrickBot |
| 2020-03-31 ⋅ FireEye ⋅ It’s Your Money and They Want It Now - The Cycle of Adversary Pursuit Ryuk TrickBot UNC1878 |
| 2020-03-31 ⋅ Cisco Talos ⋅ Trickbot: A primer TrickBot |
| 2020-03-30 ⋅ Intezer ⋅ Fantastic payloads and where we find them Dridex Emotet ISFB TrickBot |
| 2020-03-25 ⋅ Wilbur Security ⋅ Trickbot to Ryuk in Two Hours Cobalt Strike Ryuk TrickBot |
| 2020-03-18 ⋅ Bitdefender ⋅ New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong TrickBot |
| 2020-03-09 ⋅ Fortinet ⋅ New Variant of TrickBot Being Spread by Word Document TrickBot |
| 2020-03-05 ⋅ Microsoft ⋅ Human-operated ransomware attacks: A preventable disaster Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor PARINACOTA |
| 2020-03-04 ⋅ Bleeping Computer ⋅ Ryuk Ransomware Attacked Epiq Global Via TrickBot Infection Ryuk TrickBot |
| 2020-03-04 ⋅ CrowdStrike ⋅ 2020 CrowdStrike Global Threat Report MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER |
| 2020-03-03 ⋅ PWC UK ⋅ Cyber Threats 2019:A Year in Retrospect KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA |
| 2020-02-28 ⋅ Morphisec ⋅ Trickbot Delivery Method Gets a New Upgrade Focusing on Windows 10 TrickBot |
| 2020-02-26 ⋅ SentinelOne ⋅ Revealing the Trick | A Deep Dive into TrickLoader Obfuscation TrickBot |
| 2020-02-19 ⋅ FireEye ⋅ M-Trends 2020 Cobalt Strike Grateful POS LockerGoga QakBot TrickBot |
| 2020-02-18 ⋅ Sophos Labs ⋅ Nearly a quarter of malware now communicates using TLS Dridex IcedID TrickBot |
| 2020-02-13 ⋅ Qianxin ⋅ APT Report 2019 Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy |
| 2020-02-10 ⋅ Malwarebytes ⋅ 2020 State of Malware Report magecart Emotet QakBot REvil Ryuk TrickBot WannaCryptor |
| 2020-01-30 ⋅ Morphisec ⋅ Trickbot Trojan Leveraging a New Windows 10 UAC Bypass TrickBot |
| 2020-01-30 ⋅ Bleeping Computer ⋅ TrickBot Uses a New Windows 10 UAC Bypass to Launch Quietly TrickBot |
| 2020-01-29 ⋅ Bleeping Computer ⋅ Malware Tries to Trump Security Software With POTUS Impeachment TrickBot |
| 2020-01-27 ⋅ T-Systems ⋅ Vorläufiger forensischer Abschlussbericht zur Untersuchung des Incidents beim Berliner Kammergericht Emotet TrickBot |
| 2020-01-23 ⋅ Bleeping Computer ⋅ TrickBot Now Steals Windows Active Directory Credentials TrickBot |
| 2020-01-17 ⋅ Battle Against Ursnif Malspam Campaign targeting Japan Cutwail ISFB TrickBot UrlZone |
| 2020-01-16 ⋅ Bleeping Computer ⋅ TrickBot Now Uses a Windows 10 UAC Bypass to Evade Detection TrickBot |
| 2020-01-10 ⋅ CSIS ⋅ Threat Matrix H1 2019 Gustuff magecart Emotet Gandcrab Ramnit TrickBot |
| 2020-01-09 ⋅ SentinelOne ⋅ Top-Tier Russian Organized Cybercrime Group Unveils Fileless Stealthy “PowerTrick” Backdoor for High-Value Targets TrickBot WIZARD SPIDER |
| 2020 ⋅ Secureworks ⋅ GOLD BLACKBURN Dyre TrickBot |
| 2020 ⋅ Secureworks ⋅ GOLD SWATHMORE GlobeImposter Gozi IcedID TrickBot LUNAR SPIDER |
| 2020 ⋅ Secureworks ⋅ GOLD ULRICK Empire Downloader Ryuk TrickBot WIZARD SPIDER |
| 2019-12-12 ⋅ FireEye ⋅ Cyber Threat Landscape in Japan – Revealing Threat in the Shadow Cerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer (PWS) PandaBanker PLEAD poisonplug TrickBot BlackTech |
| 2019-12-09 ⋅ Palo Alto Networks Unit 42 ⋅ TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks TrickBot |
| 2019-11-22 ⋅ Palo Alto Networks Unit 42 ⋅ Trickbot Updates Password Grabber Module TrickBot |
| 2019-11-13 ⋅ CrowdStrike ⋅ Through the Eyes of the Adversary TrickBot CLOCKWORK SPIDER |
| 2019-11-08 ⋅ Palo Alto Networks Unit 42 ⋅ Wireshark Tutorial: Examining Trickbot Infections TrickBot |
| 2019-11-06 ⋅ Heise Security ⋅ Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail Emotet Ryuk TrickBot |
| 2019-10-29 ⋅ SneakyMonkey Blog ⋅ TRICKBOT - Analysis Part II TrickBot |
| 2019-10-24 ⋅ Sentinel LABS ⋅ How TrickBot Malware Hooking Engine Targets Windows 10 Browsers TrickBot |
| 2019-09-25 ⋅ GovCERT.ch ⋅ Trickbot - An analysis of data collected from the botnet TrickBot |
| 2019-08-27 ⋅ Secureworks ⋅ TrickBot Modifications Target U.S. Mobile Users TrickBot WIZARD SPIDER |
| 2019-08-26 ⋅ InQuest ⋅ Memory Analysis of TrickBot TrickBot |
| 2019-08-05 ⋅ Trend Micro ⋅ Latest Trickbot Campaign Delivered via Highly Obfuscated JS File ostap TrickBot |
| 2019-07-12 ⋅ DeepInstinct ⋅ TrickBooster – TrickBot’s Email-Based Infection Module TrickBot |
| 2019-07-11 ⋅ NTT Security ⋅ Targeted TrickBot activity drops 'PowerBrace' backdoor PowerBrace TrickBot |
| 2019-06-04 ⋅ SlideShare ⋅ Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vitali Kremez TrickBot |
| 2019-05-22 ⋅ TRICKBOT - Analysis TrickBot |
| 2019-05-09 ⋅ GovCERT.ch ⋅ Severe Ransomware Attacks Against Swiss SMEs Emotet LockerGoga Ryuk TrickBot |
| 2019-05-02 ⋅ CERT.PL ⋅ Detricking TrickBot Loader TrickBot |
| 2019-04-05 ⋅ Medium vishal_thakur ⋅ Trickbot — a concise treatise TrickBot |
| 2019-04-02 ⋅ Cybereason ⋅ Triple Threat: Emotet Deploys Trickbot to Steal Data & Spread Ryuk Ryuk TrickBot |
| 2019-03-05 ⋅ PepperMalware Blog ⋅ Quick Analysis of a Trickbot Sample with NSA's Ghidra SRE Framework TrickBot |
| 2019-02-15 ⋅ CrowdStrike ⋅ “Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web Dyre IcedID TrickBot Vawtrak LUNAR SPIDER WIZARD SPIDER |
| 2019-02-12 ⋅ Trend Micro ⋅ Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire TrickBot |
| 2019-01-11 ⋅ FireEye ⋅ A Nasty Trick: From Credential Theft Malware to Business Disruption Ryuk TrickBot GRIM SPIDER WIZARD SPIDER |
| 2018-12-12 ⋅ SecureData ⋅ The TrickBot and MikroTik connection TrickBot |
| 2018-12-05 ⋅ VIPRE ⋅ Trickbot’s Tricks TrickBot |
| 2018-11-12 ⋅ Malwarebytes ⋅ What’s new in TrickBot? Deobfuscating elements TrickBot |
| 2018-11-08 ⋅ Fortinet ⋅ Deep Analysis of TrickBot New Module pwgrab TrickBot |
| 2018-11-01 ⋅ Trend Micro ⋅ Trickbot Shows Off New Trick: Password Grabber Module TrickBot |
| 2018-08-14 ⋅ Cyberbit ⋅ Latest Trickbot Variant has New Tricks Up Its Sleeve TrickBot |
| 2018-07-03 ⋅ Talos Intelligence ⋅ Smoking Guns - Smoke Loader learned new tricks SmokeLoader TrickBot |
| 2018-06-20 ⋅ Unpacking and Extracting TrickBot Malware Configuration With x64dbg and Python TrickBot |
| 2018-06-13 ⋅ Github (JR0driguezB) ⋅ TrickBot config files TrickBot |
| 2018-04-16 ⋅ Random RE ⋅ TrickBot & UACME TrickBot |
| 2018-04-03 ⋅ Vitali Kremez Blog ⋅ Let's Learn: Trickbot Implements Network Collector Module Leveraging CMD, WMI & LDAP TrickBot |
| 2018-03-31 ⋅ Youtube (hasherezade) ⋅ Deobfuscating TrickBot's strings with libPeConv TrickBot |
| 2018-03-27 ⋅ Trend Micro ⋅ Evolving Trickbot Adds Detection Evasion and Screen-Locking Features TrickBot |
| 2018-03-21 ⋅ Webroot ⋅ TrickBot Banking Trojan Adapts with New Module TrickBot |
| 2018-02-15 ⋅ SecurityIntelligence ⋅ TrickBot’s Cryptocurrency Hunger: Tricking the Bitcoin Out of Wallets TrickBot |
| 2018-02-01 ⋅ Malware Traffic Analysis ⋅ Quick Test Drive of Trickbot (It now has a Monero Module) TrickBot |
| 2017-12-30 ⋅ Youtube (hasherezade) ⋅ Unpacking TrickBot with PE-sieve TrickBot |
| 2017-12-19 ⋅ Vitali Kremez Blog ⋅ Let's Learn: Introducing New Trickbot LDAP "DomainGrabber" Module TrickBot |
| 2017-11-22 ⋅ Flashpoint ⋅ Trickbot Gang Evolves, Incorporates Account Checking Into Hybrid Attack Model TrickBot |
| 2017-11-21 ⋅ Let's Learn: Trickbot Socks5 Backconnect Module In Detail TrickBot |
| 2017-10-06 ⋅ Blueliv ⋅ TrickBot banking trojan using EFLAGS as an anti-hook technique TrickBot |
| 2017-08-01 ⋅ Malwarebytes ⋅ TrickBot comes up with new tricks: attacking Outlook and browsing data TrickBot |
| 2017-07-27 ⋅ Flashpoint ⋅ New Version of “Trickbot” Adds Worm Propagation Module TrickBot |
| 2017-07 ⋅ Ring Zero Labs ⋅ TrickBot Banking Trojan - DOC00039217.doc TrickBot |
| 2017-06-15 ⋅ F5 ⋅ Trickbot Expands Global Targets Beyond Banks and Payment Processors to CRMs TrickBot |
| 2017-06-12 ⋅ Security Art Work ⋅ Evolución de Trickbot TrickBot |
| 2017-05-26 ⋅ PWC ⋅ TrickBot’s bag of tricks TrickBot |
| 2017-05-15 ⋅ Secureworks ⋅ Evolution of the GOLD EVERGREEN Threat Group CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN |
| 2017-03-01 ⋅ FraudWatch International ⋅ How Does the Trickbot Malware Work? TrickBot |
| 2016-12-07 ⋅ Botconf ⋅ The TrickBot Evolution TrickBot |
| 2016-12-06 ⋅ Fortinet ⋅ Deep Analysis of the Online Banking Botnet TrickBot TrickBot |
| 2016-11-09 ⋅ Tricks of the Trade: A Deeper Look Into TrickBot’s Machinations TrickBot |
| 2016-11-07 ⋅ F5 Labs ⋅ Little Trickbot Growing Up: New Campaign TrickBot |
| 2016-10-25 ⋅ NetScout ⋅ TrickBot Banker Insights TrickBot |
| 2016-10-24 ⋅ Malwarebytes ⋅ Introducing TrickBot, Dyreza’s successor TrickBot |
| 2016-10-15 ⋅ Fidelis Cybersecurity ⋅ TrickBot: We Missed you, Dyre TrickBot |