Maxim_Kazmin - Fotolia
The IcedID and TrickBot banking Trojans have apparently combined to create a dual threat that targets victims for cash. How did these two banking Trojans join forces? How do the actions of these Trojans compare to how they acted before they combined?
One of the most difficult aspects of an attack is monetizing access to a system, as the security controls on financial transactions are tight. These controls make it difficult to electronically transfer money without using traditional financial networks -- which is one reason why ransomware attacks use cryptocurrency for payments. The riskiest part of a financial attack is performed by the money mule who withdraws stolen cash from a bank account and transfers it to the handler.
Because the financial aspects are usually just one part of an attack, attackers tend to carefully segment their operations into distinct components to help prevent them from being identified; this creates a more resilient criminal enterprise. The different attack components include segments for both technical and financial aspects in which different groups might handle different parts of the overall attack. Each part needs to be successful or the attacker's financial fraud won't be successful.
In a recent blog post, Vitali Kremez, director of research at Flashpoint, discussed how the IcedID and TrickBot banking Trojans seem to have combined to create a more effective attack. The attack takes place when IcedID is spammed to victims and opened and TrickBot is downloaded.
Once TrickBot is on the system, its several modules enable it to gather data about the endpoint in order to determine what kind of financial fraud it should use. This next step is determined by the attack coordinator with the information from TrickBot. In previous IcedID attacks, the Emotet banking Trojan was used, but it has since been replaced by the TrickBot collaboration.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Enterprises have many options for email security best practices, ranging from deploying email security protocols to educating end users on the ... Continue Reading
Cyberattacks often begin with a port scan attack, which attackers use to find exploitable vulnerabilities on targeted systems. Learn how they work ... Continue Reading
Monitoring process memory is one way to combat fileless malware attacks. Here's what you can do to protect your network against these campaigns. Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.