QUESTION: Recently, the US government & @Microsoft disabled -probably temporarily -"Trickbot" one of the world’s largest hacking operations, for fear it would interfere with the U.S. election.
What is Trickbot? Our friends at @NCSC explained. Follow this thread for the answer.
What is Trickbot? Our friends at @NCSC explained. Follow this thread for the answer.
ANSWER: "Trickbot is an established banking trojan used in cyber attacks against businesses and individuals in the UK and overseas. Trickbot attacks are designed to access online accounts, including bank accounts, in order to obtain personally identifiable information
In some cases, Trickbot is used to infiltrate a network. Once inside it can be used to deploy other malware, including ransomware and post-exploitation toolkits. Trickbot targets victims with well-crafted phishing emails, designed to appear as though sent from trusted commercial
or government brands. These emails will often contain an attachment (or link to an attachment) which victims are instructed to open, leading to their machine being exploited.
What can Trickbot do?
Trickbot can download new capabilities onto a victim’s device (as well as updating those it has already deployed) without interaction from the victim; steal sensitive info, including banking login details and memorable info, gather detailed info about
Trickbot can download new capabilities onto a victim’s device (as well as updating those it has already deployed) without interaction from the victim; steal sensitive info, including banking login details and memorable info, gather detailed info about
infected devices and networks
steal saved online account passwords, cookies and web history; steal login credentials for infected devices, including domain credentials; connect infected devices to malicious, criminally-controlled networks over the internet,
steal saved online account passwords, cookies and web history; steal login credentials for infected devices, including domain credentials; connect infected devices to malicious, criminally-controlled networks over the internet,
giving criminals full control of them
spread across a victim’s network by infecting other devices, including those on trusted domains, often using SMB shares download further malicious files such as Remote Access Tools, VNC clients and ransomware"
spread across a victim’s network by infecting other devices, including those on trusted domains, often using SMB shares download further malicious files such as Remote Access Tools, VNC clients and ransomware"
For details on what to do about it, you can visit the U.K. National Cyber Security Centre ncsc.gov.uk/news/trickbot-…
If you have questions about national security, follow @NatSecAnswers, send us your question and we'll get the answer. @threadreaderapp unroll #A12
• • •
Missing some Tweet in this thread? You can try to
force a refresh
