TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks

The module, dubbed “rdpScanDll,” was discovered on
January 30 and is said to be still in development, said
cybersecurity firm Bitdefender in a report shared with The Hacker
news.

According to the researchers, the rdpScanDll brute-forcing
module has so far attempted to target 6,013 RDP servers belonging
to enterprises in telecom, education, and financial sectors in the
U.S. and Hong Kong.

The malware authors behind TrickBot specialize in releasing new
modules and versions of the Trojan in an attempt to expand and
refine its capabilities.

“The flexibility allowed by this modular architecture has turned
TrickBot into a very complex and sophisticated malware capable of a
wide range of malicious activities, as long as there is a plugin
for it,” the researchers
said.

“From add-ons for stealing OpenSSH and OpenVPN sensitive data,
to modules that perform SIM-swapping
attacks^[3] to take control of a
user’s telephone number, and even disabling Windows built-in
security mechanisms before downloading its main modules, TrickBot
is a jack-of-all-trades.”

How Does TrickBot RDP Brute-Force Module Work?

When TrickBot begins its execution, it creates a folder containing
the encrypted malicious payloads and their associated configuration
files, which includes a list of command-and-control (C2) servers
with whom the plugin needs to communicate to retrieve the commands
to be executed.

According to Bitdefender, the rdpScanDll plugin shares its
configuration file with another module named “vncDll,” while making
use of a standard URL format to communicate with the new C2 servers
— https://C&C/tag/computerID/controlEndpoint

Here, “C&C” refers to the C2 server, “tag,” the group tag
used by the TrickBot sample, “computerID,” the computer ID used by
the malware, and “controlEndpoint,” a list of attack modes (check,
trybrute and brute) and the list of IP address-port number
combinations to be targeted via an RDP brute-force attack.

The “brute” mode, per the researchers, appears to be still in
development. Not only it includes a set of executable functions
that aren’t invoked, the mode “doesn’t fetch the username list,
causing the plugin to use null passwords and usernames to
authenticate on the targets list.”

Once the initial list of targeted IPs gathered via
“/rdp/domains” is exhausted, the plugin, then, retrieves another
set of fresh IPs using a second “/rdp/over” endpoint.

Lateral Movement Plugins on Top

In addition, the Bitdefender report detailed TrickBot’s update
delivery mechanism, finding that plugins responsible for lateral
movement across the network (WormDll, TabDll, ShareDll) received
the most updates, followed by modules that helped carry out the
‘system and network’ reconnaissance (SystemInfo, NetworkDll), and
data harvesting (ImportDll, Pwgrab, aDll) over the course of last
six months.
“While monitoring the updates of malicious plugins, we observed
that the most frequently updated ones were those performing lateral
movement: 32.07% of them were wormDll, 31.44% were shareDll, and
16.35% were tabDll,” the researchers observed. “The rest of the
plugins had fewer than 5% occurrences.”

What’s more, the researchers were able to identify at least
3,460 IP addresses that acted as C2 servers across the world,
including 556 servers that were solely dedicated to downloading new
plugins and 22 IPs that served both roles.

A History of Evolving Capabilities

Disseminated via email phishing campaigns, TrickBot began its life
as a banking Trojan in 2016, facilitating financial theft. But it
has since evolved to deliver other kinds of malware, including the
notorious Ryuk
ransomware, act as an info stealer, loot Bitcoin
wallets, and harvest emails and credentials.

The malspam campaigns that deliver TrickBot use third party
branding familiar to the recipient, such as invoices from accounting
and financial^[6]
firms.

The emails typically include an attachment, such as a Microsoft
Word or Excel document, which, when opened, will prompt the user to
enable macros — thereby executing a VBScript to run a PowerShell
script to download the malware.

TrickBot is also dropped as a secondary
payload^[7] by other malware, most
notably by the Emotet botnet-driven spam campaign. To gain
persistence and evade detection, the malware has been found to
create a scheduled task and a service, and even disable and delete
Windows Defender antivirus software.

This led Microsoft to roll out a Tamper Protection
feature^[8] to safeguard against
malicious and unauthorized changes to security features last
year.

“The new rdpScanDll module may be the latest in a long line of
modules that have been used by the TrickBot Trojan, but it’s one
that stands out because of its use of a highly specific list of IP
addresses,” the researchers concluded.

“Using an existing infrastructure of TrickBot victims, the new
module suggests attackers may also be focusing on verticals other
than financial, such as telecommunications services and education &
research.”

^[1][2][4][5]