Five Months After Takedown Attempt, CISA and FBI Warn of Ongoing TrickBot Attacks

Attacks employing the TrickBot malware continue, leveraging phishing emails as the initial infection vector, the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) warn.

In a joint advisory published on Wednesday, the two agencies revealed that a sophisticated group of cybercrime actors is leveraging a traffic infringement phishing scheme to lure victims into downloading the TrickBot malware.

Initially observed in 2016 and believed to be the work of the threat actors behind the Dyre Trojan, TrickBot has become one of the most prevalent malware families out there, ensnaring machines into a botnet that was being offered under a malware-as-a-service model to both nation-states and cyber-crime groups.

In October 2020, Microsoft announced the takedown of the infrastructure behind TrickBot, but the malware survived the attempt. In fact, weeks later, it received several updates that increased its resilience against similar attempts and also provided it further compromise capabilities.

Now, CISA and the FBI reveal they have observed “continued targeting through spearphishing campaigns using TrickBot malware in North America,” thus confirming that TrickBot’s operators were able to restore their malicious operation.

“CISA and FBI are aware of recent attacks that use phishing emails, claiming to contain proof of a traffic violation, to steal sensitive information. The phishing emails contain links that redirect to a website hosted on a compromised server that prompts the victim to click on photo proof of their traffic violation,” the joint advisory reads.

Once the victim clicks on the image, however, a malicious JavaScript file is downloaded. When executed, the file connects to the attackers’ command and control (C&C) server to fetch and run TrickBot on the victim’s system.

A modular piece of malware, TrickBot is capable of stealing information from the victims’ browsers, spread laterally across the network, gather system information, manipulate system data, exfiltrate information, mine for crypto-currency, search for vulnerabilities in system firmware, and drop additional payloads onto the system, such as Emotet or the Ryuk and Conti ransomware.

In their joint advisory, CISA and FBI included a series of recommendations for network defenders looking to improve their security posture and stay better protected against TrickBot attacks. The recommendations apply to security teams at federal, state, local, tribal, and territorial governments, but also to those in the private sector.

Related: CISA Issues Advisory for High-Severity Vulnerabilities in Fuji Electric HMI Products

Related: CISA Says Many Victims of SolarWinds Hackers Had No Direct Link to SolarWinds

Related: CISA Warns Organizations About Attacks on Cloud Services