Trickbot malware infects 140,000+ devices of customers from tech giants

Trickbot malware infects 140,000+ customer devices of tech giants

According to researchers, TrickBot malware has targeted customers of over 60 high-profile corporations since November 2020 including Google, Microsoft, PayPal, Bank of America, and others.

As per the latest report published by Check Point Research Team, TrickBot developers are constantly striving to improvise the malware’s functionalities. For your information, TrickBot is a banking trojan that first emerged in 2016 and since has evolved into an all-encompassing ecosystem of a botnet, malware, and ransomware over the years.

140,000+ TrickBot Infections Since Nov 2020

According to Check Point researchers, there has been significant activity from TrickBot operators since 2020. The report comprised data obtained since November 2020, during which the company claims over 140,000 devices have been infected by the trojan, targeting customers of around sixty high-profile corporations, including but not limited to the following:

  1. PayPal
  2. Google
  3. Amazon
  4. Microsoft
  5. Wells Fargo
  6. Bank of America
  7. American Express

TrickBot hits devices used by general public

Check Point’s cybersecurity, research, and innovation manager, Alexander Chailytko, noted that these 140,000 machines infected over 16 months are mainly computers used by the general public and some organizations. This number is not final, which is why the company wrote over 140,000 machines since the gathered data represents the telemetry received from customers of Check Point.

However, the company is certain that at least 1 out of every 45 companies might be impacted by TrickBot. Most modules of the trojan are used to steal login credentials from customers of large-scale banks.

Full list of targeted companies according to CheckPoint:

AmericanExpressCredit Card Service
AmeriTradeFinancial Services
AOLOnline service provider
Associated Banc-CorpBank Holding
Bank of MontrealInvestment Banking
Barclays Bank DelawareBank
Blockchain.comCryptocurrency Financial Services
Canadian Imperial Bank of CommerceFinancial Services
Capital OneBank Holding
Card Center DirectDigital Banking
Centennial BankBank Holding
ChaseConsumer Banking
CitiFinancial Services
CitibankDigital Banking
Citizens Financial GroupBank
CoamericaFinancial Services
Columbia BankBank
Desjardins GroupFinancial Services
E-TradeFinancial Services
FidelityFinancial Services
Fifth ThirdBank
FundsXpressIT Service Management
GoToMyCardFinancial Services
HawaiiUSA Federal Credit UnionCredit Union
Huntington BancsharesBank Holding
Huntington BankBank Holding
Interactive BrokersFinancial Services
JPMorgan ChaseInvestment Banking
LexisNexisData mining
M&T BankBank
Navy FederalCredit Union
PayPalFinancial Technology
PNC BankBank
RBC BankBank
RobinhoodStock Trading
Royal Bank of CanadaFinancial Services
SchwabFinancial Services
Scotiabank CanadaBank
SunTrust BankBank Holding
SynchronyFinancial Services
SynovusFinancial Services
T. Rowe PriceInvestment Management
TD BankBank
TD Commercial BankingFinancial Services
Truist FinancialBank Holding
U.S. BancorpBank Holding
UnionBankCommercial Banking
USAAFinancial Services
VanguardInvestment Management
Wells FargoFinancial Services
ZoomInfoSoftware as a service
According to Check Point above mentioned (59) organizations have been targeted by TrickBot malware.

TrickBot Transition

According to Check Point’s report, TrickBot authors have added the botnet with anti-analysis and anti-deobfuscation layers to enhance its capabilities. So, if a researcher tries to decipher its code, the malware stops communicating its C2 server and stops working entirely.

Researchers wrote that the inclusion of such features reveals that TrickBot operators are highly skilled, which explains why it has continued to remain a “prevalent malware family.” It is worth noting that last month Hackread published a detailed report based on the findings of IBM researchers revealing that TrickBot malware has added a new feature that crashes researchers’ devices to evade analysis.

Is TrickBot Breathing its Last?

Most security researchers, including Hold Security, a dark web monitoring platform, believe that TrickBot Trojan is breathing its last. Its days are numbered because most gang members have left the group operating it. Recently, Check Point has detected a decline in the botnet’s activity.

Researchers suggest users should open documents only from trusted sources and use complicated and different passwords for different accounts. Moreover, they must keep antivirus software and operating systems updated to prevent infection.

More TrickBot malware news:

  1. Cyber Security companies dismantle Trickbot ransomware botnet
  2. Emotet malware reemerges, building botnet via Trickbot malware
  3. New Trickbot attack setup fake 1Password installer to extract data
  4. Black Lives Matter movement exploited to spread Trickbot malware
  5. TrickBot malware now crashes researchers’ devices to evade analysis

Related Posts