I've seen it lead to PowerShell Empire being deployed, and so.
PowerShell Empire is another attacker toolset that can be used
to kind of move throughout an environment,
grab information off,
it has built-in Mimikatz capabilities to dump
credentials from memory and things like that.
And TrickBot is often used to kind of gain that
foothold and spread through the network,
and then once they get to where they want,
to get the information they want, they use it most likely to deploy ransomware.
And then oftentimes I'll get brought into an incident where an
organization has been infected by ransomware and immediately we
look for TrickBot because 9 times out of 10,
TrickBot is on the network and that's how the attackers got on.
(Aaron) Yeah, so when you see that,
what kind of ransomware is it generally deploying?
Is it the same ransomware, or is it going to be different kinds?
(Tyler) No, it's not always the same ransomware.
Most of the time though, it's the Ryuk ransomware.
(Aaron) Okay.
(Tyler) The big thing is, it's not any really poorly written ransomware.
It's not something where you're just going to be able to
go out and get a decrypter for it,
you're going to have to rely upon your backups,
or if you don't have backups then your only option might be to pay the ransom.
(Aaron) So with the ransomwares deploying,
or maybe PS Empire tools that are being deployed,
is there a way that we can engage a kind of the version of TrickBot that
you're getting or whether it's been updated or not?
(Tyler) You can a little bit.
That relies more upon whoever's behind TrickBot,
but there are different indicators that you can look at in
like the network traffic that TrickBot generates that
indicates what version it is, what campaign it is,
and even potentially how long that campaign has been in place.