TrickBot Update Indicates Shifting Focus Back to Banking Fraud
TrickBot is a name that anyone who reads up on malware and security news must have ran across at some point in time. What originally started as the TrickBot banking trojan back in 2016 and was primarily used to steal banking and card information from victims, slowly evolved into a multi-purpose modular malware toolkit.
Even though for the past couple of years TrickBot was primarily used as a vehicle to deliver ransomware including the infamous Ryuk and Conti families, its latest update indicates that the bad actors behind the malware are looking to sharpen its banking fraud and theft capabilities once again, with a possible shift of focus back to stealing credentials.
Security researchers working with Kryptos Logic Threat Intelligence have been looking into the newest versions of TrickBot and their findings are intriguing. TrickBot is adding credential theft mechanisms that resemble those found in the Zeus banking trojan, with the ability of the malware to execute man-in-the-browser attacks. This is achieved using web injections.
When a victim infected with the latest version of TrickBot attempts to open a legitimate banking website, the malware's web injection module comes into play. The injection can be both static or dynamic, with the static version routing the user to a hacker-controller website that mimics the legitimate banking service. Once the user enters their credentials in the fake page, it's easy to imagine what happens next.
The dynamic injection is more sophisticated and involved forwarding the server's response to the command and control servers of TrickBot, where the page source is dynamically altered. The malware-laced page is then returned to the user's browser, acting as though it was loaded up from the legitimate banking site.
The similarity with Zeus comes in the update to the web inject module, which now contains what researchers call "Zeus-style" injection configuration settings. This gives TrickBot yet another way to dynamically alter pages served to the victim's browser.
The reason why hackers still copy bits and pieces of Zeus, even though the Zeus trojan has had its source code leaked for a decade now, is that it was the pinnacle of banking trojans for a long time and some of those techniques, when modified to fit the needs of current-day malware, still pull their weight.
In summary, researchers pointed out that the new functionality may indicate the threat actor behind TrickBot may be looking to expand on their malware service platform and allow licensees and budding new hackers who use TrickBot to write their own web injection configurations and modules.
