(Aaron) I see.
More focused on TrickBot itself rather than next stage because
we're going to get into how TrickBot is deployed,
generally through some other means as well.
And then what TrickBot consists of, what it does while it's on your network.
Are there any specifically novel, like, exploit techniques that are used,
or is it all just mainly standard stuff that's known,
just packaged well into a good software product essentially?
(Tyler) To get on the network or to move laterally, or both?
(Aaron) Either.
Is there any particularly, you know,
what use to be a zero day would not be any longer after deployment,
but is there any like special exploit that came from this group,
or are they kind of just leveraging other exploits that are already known?
(Tyler) You know, to get on the initial system it's usually not something novel,
it's something that security professionals have been seeing for years.
Most of the time what'll happen is a user will go to the wrong website,
they'll get hit by a malicious ad online,
and they'll go to a malicious website,
which does a drive-by download and installs some initial malware on the system,
or they'll get that phishing email which has them
kind of click out to some link, maybe a malicious document.
And those initial footholds will usually download
kind of like a first stage malware, usually something like EMOTET,
and then EMOTET will immediately turn around and download TrickBot.
And then TrickBot just starts to do its thing.
Moving laterally into the environment, it can do it a number of ways.
It will use the EternalBlue or the EternalRomance vulnerabilities,
and it also has the ability to brute force passwords and even grab some
passwords out of memory and try to use those to move around.
(Aaron) Oh, wow.
And that's all happening automatically once it's on the system?
(Tyler) Yes.