Trickbot Malware Returns with a new VNC Module to Spy on its Victims

Cybersecurity researchers have opened the lid on the continued
resurgence of the insidious TrickBot malware, making it
clear that the Russia-based transnational cybercrime group is
working behind the scenes to revamp its attack infrastructure in
response to recent counter efforts from law enforcement.

“The new capabilities discovered are used to monitor and gather
intelligence on victims, using a custom communication protocol to
hide data transmissions between [command-and-control] servers and
victims — making attacks difficult to spot,” Bitdefender said^[1]
in a technical write-up published Monday, suggesting an increase in
sophistication of the group’s tactics.

“Trickbot shows no sign of slowing down,” the researchers
noted.

Botnets are formed when hundreds or thousands of hacked devices
are enlisted into a network run by criminal operators, which are
often then used to launch denial-of-network attacks to pummel
businesses and critical infrastructure with bogus traffic with the
aim of knocking them offline. But with control of these devices,
malicious actors can also use botnets to spread malware and spam,
or to deploy file-encrypting ransomware on the infected
computers.

TrickBot is no different. The notorious cybercrime gang behind
the operation — dubbed Wizard Spider^[2]
— has a track record of exploiting the infected machines to steal
sensitive information, pivot laterally across a network, and even
become a loader for other malware, such as ransomware^[3], while constantly
improving their infection chains by adding modules with new
functionality to increase its effectiveness.

“TrickBot has evolved to use a complex infrastructure that
compromises third-party servers and uses them to host malware,”
Lumen’s Black Lotus Labs disclosed^[4]
last October. “It also infects consumer appliances such as DSL
routers, and its criminal operators constantly rotate their IP
addresses and infected hosts to make disruption of their crime as
difficult as possible.”

The botnet has since survived two takedown attempts^[5]
by Microsoft and the U.S. Cyber Command, with the operators
developing firmware meddling components that could allow the
hackers to plant a backdoor^[6]
in the Unified Extensible Firmware Interface (UEFI), enabling it to
evade antivirus detection, software updates, or even a total wipe
and reinstallation of the computer’s operating system.

Now according to Bitdefender, the threat actor has been found
actively developing an updated version of a module called “vncDll”
that it employs against select high-profile targets for monitoring
and intelligence gathering. The new version has been named
“tvncDll.”

The new module is designed to communicate with one of the nine
command-and-control (C2) servers defined in its configuration file,
using it to retrieve a set of attack commands, download more
malware payloads, and exfiltrate gathered from the machine back to
the server. Additionally, the researchers said they identified a
“viewer tool,” which the attackers use to interact with the victims
through the C2 servers.

While efforts to squash the gang’s operations may not have been
entirely successful, Microsoft told^[7]
The Daily Beast that it worked with internet service providers
(ISPs) to go door-to-door replacing routers compromised with the
Trickbot malware in Brazil and Latin America, and that it
effectively pulled the plug on Trickbot infrastructure in
Afghanistan.