After evading law enforcement's takedown attempts over the past four years, TrickBot's days are now numbered as it will soon be replaced by the BazarBackdoor (opens in new tab) malware.
The reason being is that the top members of TrickBot have joined the Conti ransomware syndicate according to a new report (opens in new tab) from the cybercrime and adversarial disruption firm Advanced Intelligence (AdvIntel).
For those unfamiliar, TrickBot (opens in new tab) is a Windows malware (opens in new tab) platform that utilizes multiple modules to conduct a variety of malicious activities such as information and password stealing, infiltrating Windows domains, gaining access to corporate networks and delivering malware. The developers of TrickBot have partnered with ransomware gangs to take over and infect millions of devices around the world since 2016.
While the Ryuk (opens in new tab) ransomware gang first partnered with TrickBot to gain access to its technology, the group was replaced by the Conti ransomware gang (opens in new tab) which has been using its malware over the course of the past year to gain access to corporate networks. According to AdvIntel, the group that managed the various TrickBot campaigns is an elite division of cybercriminals known as Overdose which has brought in at least $200m from its nefarious activities online.
Under new management
Last year security researchers at AdvIntel noticed that Conti had become the only user of TrickBot's botnet product (opens in new tab). By the end of 2021 though, Conti had essentially acquired TrickBot with multiple elite developers and managers joining the ransomware gang.
> Trickbot is no longer the world's leading malware threat (opens in new tab)
> US military officially confirms action against ransomware groups (opens in new tab)
> Ransomware is now a billion-dollar market (opens in new tab)
What sets Conti apart from other ransomware gangs is that it uses a “trust-based, team-based” model as opposed to working with random affiliates. As a result, the group has been better at evading law enforcement than many of its peers.
Going forward, the Conti ransomware group plans to use TrickBot's newer product, the BazarBackdoor malware, as it is stealthier and harder to detect. Although BazarBackdoor used to be a part of TrickBot's larger toolkit, it has since become its own fully autonomous tool according to AdvIntel.
While the TrickBot malware's day in the sun may be over, the Conti ransomware group will continue to target businesses using BazarBackdoor. At the same time, the former leaders of TrickBot are now operating under Conti's direction and the group will likely use their talents to launch even more attack campaigns.
- We've also featured the best antivirus (opens in new tab) and the best ransomware protection (opens in new tab)
Via BleepingComputer (opens in new tab)