Talking about cybercrime, you've probably heard of Trickbot malware, so what is it? Today let's learn more about it!
##What is Trickbot?
TrickBot is complex, modular malware that started out as a banking Trojan but has evolved to support many different types of attacks, including ransomware. TrickBot is often spread through phishing campaigns that entice individuals to open malicious attachments or click on links leading to malicious files.
Many of the tricks this Trojan has pulled off since its discovery in 2016 are thanks to the creativity and agility of its developers. In addition to stealing capabilities, TrickBot is also granted the ability to move laterally and gain a foothold in the affected network by exploiting, propagating copies of itself through Server Message Block (SMB) sharing. , removes other malware such as Ryuk ransomware and searches for documents and media files on infected servers.
##Harmful effects of Trickbot
With its evolution into modular malware, TrickBot has become more and more dangerous, and it has the following dangers:
- Credential theft: Steal a consumer's online banking credentials or a business user's corporate credentials.
- Data theft: Exfiltrate the organization's data to the attacker's server.
- Persistence: Establishing and maintaining a covert presence within a network, often through a backdoor allowing remote access, to support ongoing illegal activity.
- Other malware distribution: Download other malware, such as remote access tools and ransomware.
- Reconnaissance: Collect information about systems and networks for future use.
- Botnet: Connects the victim's device to the cybercriminal's command and control (C2) server to use in illegal botnet operations.

##How does TrickBot spread?
TrickBot arrives at affected systems as embedded URLs or infected attachments in malicious spam campaigns.
Once executed, TrickBot will spread throughout the network by exploiting the SMB vulnerability using one of three widely known NSA exploits: EternalBlue, EternalRomance and EternalChampion.
##Who is Trickbot aimed at?
TrickBot is primarily a threat to small, medium and large enterprise organizations, although cybercriminals can also use it to target individual consumers.
The US government has expressed concern about the possibility that TrickBot and other ransomware attacks could disrupt the election. Adversaries could use them to target voter counting systems, aiming to sow distrust in the electoral system.
Cybercriminals have also used TrickBot to target many other sectors, such as healthcare. In these cases, malware is often used to inject ransomware for financial gain.
##How to protect yourself from Trickbot malware
The presence of Trickbot for systems, organizations, businesses and individuals is extremely dangerous, so we must take measures to protect ourselves from Trickbot, here are some measures:
Connect with individuals
- The first thing is to raise awareness about malware.
- Check your email inbox, absolutely do not open and click on strange links in your inbox.
- Use virus detection and stacking software.
- Turn on 2-factor authentication to help prevent Trickbot from getting too much of your user information.
- Use online anonymous tools such as: SMSer.net (Receive sms online), Smailpro.com (Temp mail), Ugener.com (Fake name generator), Cardgener.com (Random credit card numbers generator) to protect Protect your real personal information.
For systems and organizations:
1. Look for possible Indicators of Compromise (IOCs) by running tools specifically designed to do this, such as the Farbar Recovery Scan Tool (FRST). Doing this will identify infected machines on the network.
2. Once the machine is identified, isolate the infected machines from the network.
3. Download and apply patches that address vulnerabilities exploited by TrickBot.
4. Disable administrative sharing.
5. Change all local and domain administrator passwords.

##Final
Trickbot malware is extremely dangerous to global cybersecurity. Raise awareness and take precautions against its harmful effects. Thank you!