Trickbot malware infects 140,000+ customer devices of tech giants

According to researchers, TrickBot malware has targeted customers of over 60 high-profile corporations since November 2020 including Google, Microsoft, PayPal, Bank of America, and others.

As per the latest report published by Check Point Research Team, TrickBot developers are constantly striving to improvise the malware’s functionalities. For your information, TrickBot is a banking trojan that first emerged in 2016 and since has evolved into an all-encompassing ecosystem of a botnet, malware, and ransomware over the years.

140,000+ TrickBot Infections Since Nov 2020

According to Check Point researchers, there has been significant activity from TrickBot operators since 2020. The report comprised data obtained since November 2020, during which the company claims over 140,000 devices have been infected by the trojan, targeting customers of around sixty high-profile corporations, including but not limited to the following:

1. PayPal
2. Google
3. Amazon
4. Microsoft
5. Wells Fargo
6. Bank of America
7. American Express

TrickBot hits devices used by general public

Check Point’s cybersecurity, research, and innovation manager, Alexander Chailytko, noted that these 140,000 machines infected over 16 months are mainly computers used by the general public and some organizations. This number is not final, which is why the company wrote over 140,000 machines since the gathered data represents the telemetry received from customers of Check Point.

However, the company is certain that at least 1 out of every 45 companies might be impacted by TrickBot. Most modules of the trojan are used to steal login credentials from customers of large-scale banks.

Full list of targeted companies according to CheckPoint:

TrickBot Transition

According to Check Point’s report, TrickBot authors have added the botnet with anti-analysis and anti-deobfuscation layers to enhance its capabilities. So, if a researcher tries to decipher its code, the malware stops communicating its C2 server and stops working entirely.

Researchers wrote that the inclusion of such features reveals that TrickBot operators are highly skilled, which explains why it has continued to remain a “prevalent malware family.” It is worth noting that last month Hackread published a detailed report based on the findings of IBM researchers revealing that TrickBot malware has added a new feature that crashes researchers’ devices to evade analysis.

Is TrickBot Breathing its Last?

Most security researchers, including Hold Security, a dark web monitoring platform, believe that TrickBot Trojan is breathing its last. Its days are numbered because most gang members have left the group operating it. Recently, Check Point has detected a decline in the botnet’s activity.

Our Dark Web sources report that Trickbot gang lost its key members over the past 24 hours. Looks like Russian government actions are driving ransomware gangs to close their doors. Hopefully this is going to be it for the one of most notorious ransomware gangs of our time.

— HoldSecurity (@HoldSecurity) February 11, 2022

Researchers suggest users should open documents only from trusted sources and use complicated and different passwords for different accounts. Moreover, they must keep antivirus software and operating systems updated to prevent infection.

More TrickBot malware news:

1. Cyber Security companies dismantle Trickbot ransomware botnet
2. Emotet malware reemerges, building botnet via Trickbot malware
3. New Trickbot attack setup fake 1Password installer to extract data
4. Black Lives Matter movement exploited to spread Trickbot malware
5. TrickBot malware now crashes researchers’ devices to evade analysis