Cybersecurity (opens in new tab) researchers have detected a significant increase in the activity of the infamous Trickbot malware (opens in new tab), with a large number of new command and control (C2) centers deployed around the world, as well as a new module for monitoring and intelligence gathering.
Trickbot, which has been used to perpetrate all types of financial cyber attacks including the delivery of ransomware (opens in new tab), was at the receiving end of a massive campaign (opens in new tab) by cyber sleuths last year.
However, researchers from Bitdefender (opens in new tab), who have been tracking Trickbot, have recently picked up a resurgence in the activity of the malware, with new infrastructure and new capabilities.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
>> Click here to start the survey in a new window (opens in new tab) <<
- These are the best endpoint protection tools (opens in new tab)
- Here's our choice of the best malware removal (opens in new tab) software on the market
- Check our list of the best firewall apps and services (opens in new tab)
“During our investigation we also stumbled on an additional tool used by the Trickbot group to facilitate the access of other threat actors to the victims’ computers,” note the researchers in their analysis (opens in new tab).
Rising from the ashes
After last year’s take down attempt, the Trickbot group appears to have been recuperating, and based on Bitdefender’s observations, looks all set to get back into action.
Bitdefender first picked up an updated version of the vncDll module that Trickbot uses against select high-profile targets, a couple of months back in May 2021. Now known as tvncDll, the actively developed module will now be used by Trickbot for monitoring and intelligence gathering purposes.
“This module, vncDll/tvncDll, uses a custom communication protocol, which only makes it harder to understand what data is being transmitted without prior knowledge,” says Bitdefender as it unravels the groups’ new activity.
The new module interacts with one of the nine C2 servers defined in its configuration file. According to Bitdefender’s research, the C2 servers send additional malware payloads, and also facilitate the exfiltration of sensitive data from the victim’s machine.
The malware now also has a password dumping functionality and “is in active development, with multiple weekly updates,” according to Bitdefender.
- Protect your devices with these best antivirus software (opens in new tab)