Thread by @BleepinComputer

TrickBot's new Linux malware covertly infects Windows devices - @LawrenceAbrams
bleepingcomputer.com/news/security/…

TrickBot has ported their Windows Anchor_DNS malware to a native Linux malware executable that can also be used to infect other Windows devices on the network.

TrickBot's Anchor platform is used for high-value/high-impact targets where ransomware may be deployed, or more APT-like attacks targeting point-of-sale and financial systems.
labs.sentinelone.com/the-deadly-pla…
hello.global.ntt/zh-cn/insights…
cybereason.com/blog/dropping-…

Recently @professor__plum discovered that TrickBot had ported their Anchor_DNS backdoor, which communicates with the C2 via DNS, to a Linux malware called Anchor_Linux. This malware is a backdoor dropper, but also includes a method to infect Windows devices on the network.

Embedded in the Linux malware exec is a Windows malware executable. Anchor_Linux will copy this executable to Windows devices using SMB and .

Anchor_Linux will then create a service and use it start the copied malware on the Windows device. This is done using the Service Control Manager Remote protocol and the SMB SVCCTL named pipe.

This allows Linux devices to be used to covertly spread TrickBot throughout an organization's Windows devices. Organizations that use a mixed OS environment need to make sure that Linux devices and IoT devices running Linux are properly monitored.

For further analysis, you can also see the tweets by @VK_Intel @IntezerLabs

https://twitter.com/VK_Intel/status/1288541754728341505?s=20

Intezer's info is here:

https://twitter.com/IntezerLabs/status/1288487307369222145