New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong

Author:
Radu Tudorica – Security Researcher, Cyber Threat Intelligence Lab
Co-authors:
Alexandru Maximciuc – Team Leder, Cyber Threat Intelligence Lab
Cristina Vatamanu – Senior Team Leader, Cyber Threat Intelligence Lab

Bitdefender researchers have discovered a new TrickBot module (rdpScanDll) built for RDP bruteforcing operations on select targets. The new module was discovered on January 30 and, based on the IP addresses it targets, victims seem to be US and Hong Kong-based, predominantly in the telecom industry.

While TrickBot is a Trojan that has been around since 2016, it started out as a credential-harvesting threat mostly focusing on e-banking, while its plugin-based design has made it much more than just a threat focused on financial data theft. Security companies and researchers have previously analyzed a wide range of modules, proving that the Trojan is still under active development and undergoing constant “feature upgrades”.

Key Findings:

rdpScanDll:

• New module that bruteforces RDP for a specific list of victims
• Still in development, as the module features a broken attack mode
• Targets mostly in telecom, education, and financial services in the United States and Hong Kong

TrickBot:

• Lateral movement modules receive the most updates
• Dynamic C&C infrastructure, mostly based in Russia.
• Over 100 new C&C IPs added each month, with an average lifetime of about 16 days

The flexibility allowed by this modular architecture has turned TrickBot into a very complex and sophisticated malware capable of a wide range of malicious activities, as long as there is a plugin for it.

TrickBot has been mostly distributed through spam campaigns but it was also seen in cahoots with other threats. Distributed by the Emotet spam-sending botnet to deliver Ryuk ransomware, TrickBot operators have extended its capabilities into one of the most advanced malware delivery vehicles out there.

Bitdefender have kept a close eye on TrickBot and on January 30, 2020, our monitoring systems reported the delivery of a new module, performing bruteforce operations on a list of targets defined and sent by the attackers.