Discover ESET

Our vision, values and technology.

Newsroom

Get the latest ESET updates.

Press releases

Company news at your fingertips.

Press contacts

Contact information for media and agencies.

Careers

Build a career with ESET.

ESET takes part in global operation to disrupt Trickbot, a botnet that has infected over a million computers

Next story

Trickbot steals credentials and, recently, has deployed ransomware; ESET Research contributed with technical analysis to the effort

BRATISLAVA – ESET researchers have participated in a global operation to disrupt the Trickbot botnet, which has, since 2016, infected over a million computing devices. Along with partners Microsoft, Lumen's Black Lotus Labs Threat Research, NTT and others, the operation impacted Trickbot by tanking their command and control servers. ESET contributed to the effort with technical analysis, statistical information, and known command and control server domain names and IPs. Trickbot is known for stealing credentials from compromised computers and, more recently, has been observed mostly as a delivery mechanism for more damaging attacks, such as ransomware.

ESET Research has been tracking its activities since its initial detection in late 2016. In 2020 alone, ESET’s botnet tracker platform analyzed more than 125,000 malicious samples and downloaded and decrypted more than 40,000 configuration files used by the different Trickbot modules, giving an excellent viewpoint of the different C&C servers used by this botnet.

“Over the years we’ve tracked it, Trickbot compromises have been reported in a steady manner, making it one of the largest and longest-lived botnets out there. Trickbot is one of the most prevalent banking malware families, and this malware strain represents a threat for internet users globally,” explains Jean-Ian Boutin, Head of Threat Research at ESET. 

Throughout its existence, this malware has been distributed in a number of ways. Recently, a chain we observed frequently is Trickbot being dropped on systems already compromised by Emotet, another large botnet. In the past, Trickbot malware was leveraged by its operators mostly as a banking trojan, stealing credentials from online bank accounts and trying to perform fraudulent transfers.


One of the oldest plugins developed for the platform allows Trickbot to use web injects, a technique allowing the malware to dynamically change what the user of a compromised system sees when visiting specific websites. “Through our monitoring of Trickbot campaigns, we collected tens of thousands of different configuration files, allowing us to know which websites were targeted by Trickbot’s operators. The targeted URLs mostly belong to financial institutions,” adds Boutin.

“Trying to disrupt this elusive threat is very challenging as it has various fallback mechanisms, and its interconnection with other highly active cybercriminal actors in the underground makes the overall operation extremely complex,” concludes Boutin.

For more technical details on Trickbot, read the full blog post “ESET takes part in global operation to disrupt Trickbot” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About ESET 
For more than 30 years, ESET® has been developing industry-leading IT security software and services to protect businesses, critical infrastructure and consumers worldwide from increasingly sophisticated digital threats. From endpoint and mobile security to endpoint detection and response, as well as encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively protect and monitor 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company that enables the safe use of technology. This is backed by ESET’s R&D centers worldwide, working in support of our shared future. For more information, visit www.eset.com or follow us on LinkedIn, Facebook , and Twitter.