The Trickbot botnet malware, which often distributes various ransomware strains, continues to be the most prevalent threat as its developers update the VNC module used for remote control of infected systems.
Its activity has been steadily increasing since the complete shutdown of the Emotet botnet in January, which acted as a distributor for both Trickbot and other high-profile threat actors.
See also: The group behind Trickbot is linked to the Diavol ransomware
The most widespread threat
Trickbot has been around for almost half a decade and has gone from a banking trojan to one of the largest botnets circulating today that sells access to various threat actors.
Some of the ransomware enterprises using this botnet to access the network are Ryuk, Conti, REvil, as well as a new one called Diavol, Romanian for Devil.
Since Emotet was removed by law enforcement, Trickbot activity began to increase to such levels that in May it was the most prevalent malware on Check Point's radar.
The malware maintained its position this month, the cybersecurity firm noted in a report today, adding that Trickbot's maintainers are constantly working to improve it.
According to Check Point, Trickbot affected 7% of organizations worldwide, followed by the XMRig cryptocurrency miner the Formbook info stealer, which affected 3% of organizations monitored by Check Point worldwide.
See also: US DoJ: Accuses Latvia of developing Trickbot malware
New VNC module in the project
In another report, Romanian cybersecurity firm Bitdefender says its systems detected a new Trickbot VNC module (vncDLL), which was used after breaches of high-profile targets.
The updated module is called tvncDLL and allows the threat actor to monitor the victim and collect information.
Although tvncDLL was discovered on May 12, researchers say it is still under development, "as the team has a frequent update schedule, regularly adding new features and bug fixes.".
Bitdefender's analysis points out that it uses a custom communication protocol and reaches the command and control (C2) server through one of nine proxy IP addresses that allow access to victims behind firewalls.
The VNC component can stop Trickbot and unload it from memory. When an operator initiates communication, the module creates a virtual desktop with a customized interface.
Using the command line, the threat actor can download new payloads from the C2 server, open documents and incoming emails, and steal data from the compromised system.
See also: Trickbot: New module uses Masscan for local network identification
Another option called Native Browser activates a Web browser by taking advantage of the OLE automation feature in Internet Explorer.
The feature is under development and its purpose is to steal passwords from Google Chrome, Mozilla Firefox, Opera, and Internet Explorer.
Researchers say that while the old vncDLL module has been in use since at least 2018, its successor was activated on May 11, 2021, according to data uncovered during their investigation.
Information source: bleepingcomputer.com
