Just when you think you're safe from the defunct banking trojan Dyre, it resurfaces again in a new form. Threat researcher Jason Reaves wrote in a blog that a new banking Trojan, being called TrickBot has surfaced and looks suspiciously similar to Dyre. The assumption is that those who escaped arrest by Russian authorities when Dyre was taken down in late 2015 are behind this one too.
As with most malware, it often ends up on users’ machines and devices via phishing attacks. Spam is sent that includes a link or attachment infected with the malware that goes after information, such as login credentials. So always be on the lookout for these messages. If you are not 100% sure they are safe, don’t click them. Even if you know the sender or it looks like it’s an invoice or other business document, it doesn’t mean the link or attachment is free of malware. Email addresses are stolen all the time. In fact, around 117 million were stolen when LinkedIn was breached and the recent Yahoo breach resulted in theft of 500 million addresses. That gives hackers a lot of senders to use in their spam emails. If just a small percentage of those who receive these clicks and executes the malware, it could mean a big payday for the bad guys.
While phishing is getting more difficult to detect, the main question to ask is whether or not you are expecting to receive an attachment or link. If not, verify it with the sender before taking any action. Do this by walking to his or her desk, making a phone call, or asking over the cubicle wall. You can also send a brand-new email back and confirm. Just don’t reply to the sender. That will just go back to the hackers and of course they will confirm it.
TrickBot has been around since September, as far as anyone can tell and has been targeting Australian banks thus far. However, it’s unlikely to stay there for long. Look for it in an email near you. While much of it mimics Dyre and has similarities with Vawtrak, such as their task to steal banking credentials, it uses different encryption. However, it’s so close that few doubt its origins at this point.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
