After many months of testing, the new banking Trojan called TrickBot has begun carrying out attacks on personal and business bank account owners in the UK and Australia.
TrickBot is reportedly fully functional and deploys two advanced browser manipulation techniques (server-side injections and redirection attacks) to compromise banking sessions.
Its effectiveness was first tested by its creators last month, and in November it was released with two new synthetics in its malware. One targets customers from four banks in the UK with redirect attacks, and the other hits bank account holders at Australian banks using server-side injections.
Users of financial institutions in New Zealand, Germany, and Canada are also targets of TrickBot but to a lesser extent, at least to date.
The malware's distribution choices by its creators show a preference for corporate bank accounts.
“They’re sending the malware in spam to companies, in waves,” says IBM security consultant Limor Kessem. They’ve also tried testing the Rig exploit kit.
Researchers report that TrickBot has similarities to the Cutwail botnet malware and uses the same crypter as Vawtrak, Pushdo, and Cutwail.
TrickBot is poised to become the next big threat, and a serious contender in the banking malware market.
