Evolution of Trickbot banking trojan with 61 sophisticated techniques

Source: © weerapat1003 - Fotolia.com

Trickbot is a descendant of the Dyre banking trojan, which originated as a trojan stealing banking data and account credentials. Today Trickbot has evolved and became a multi-modular malware ranging its activity from data theft to other malware distribution (such as Ryuk ransomware).

Overall, Kaspersky researchers have analysed 61 modules of Trickbot and discovered the trojan has acquired dozens of auxiliary modules that steal credentials and sensitive information. The malware spreads over local networks using stolen credentials and vulnerabilities, provides remote access, proxy network traffic, performs brute-force attacks and downloads other malware.

Trickbot targets companies and individual users around the world. According to Kaspersky, Trickbot’s activity is not geographically limited and most of the affected users were located in the USA (13.21%), Australia (10.25%) and China (9.77%), followed by Mexico (6.61%) and France (6.30%).

“Cybercriminals always update and refresh their toolsets. Right now, Trickbot has developed and became one of the most powerful and dangerous samples of its malware type. As cybercriminals evolve, so should protection techniques. Most of the attacks can be prevented, that is why it is important to have an up-to-date security solution,” comments Oleg Kupreev, security expert at Kaspersky.

Kaspersky security solutions successfully detect and block all known versions of the Trickbot banking trojan.

Learn more about Trickbot on Securelist.

To stay safe from financial threats like Trickbot, Kaspersky experts recommend that you:

• Do not follow links in spam messages nor open documents attached to them.
  
• Use online banking with multifactor authentication solutions.
  
• Make sure all of your software is updated – including your operating system and all software applications (attackers exploit loopholes in widely used programs to gain entry).
  
• Use a trusted security solution that can help you check the security of the URL you’re visiting and open any site in a protected container to prevent theft of sensitive data (like financial information).