(Aaron) You said there's different ways that this is downloaded initially.
Sure, we get the first kind of stage, which would be EMOTET or Ursnif, right?
(Tyler) Right, right.
(Aaron) So if I try it by download or like a phishing campaign,
is this kind of indicative of different groups
behind the same malware deployment?
(Tyler) You know, I think it is.
Probably what's going on here is you have different groups that are
probably selling their services to each other.
So you probably have a group that is, really,
their specialty is doing the phishing or the drive-by downloads and they're
using EMOTET and they're kind of selling their services to the TrickBot
people who are using EMOTET to get on the systems.
And then once the TrickBot people get on the systems,
they'll kind of move in the environment get whatever information they want,
get on the systems that they want,
and either they're deploying ransomware or they're actually
selling their access through their backdoors,
through TrickBot,
to some other ransomware people who are then deploying the ransomware.
(Aaron) So it's like a big underground criminal B2B market?
(Tyler) Oh yeah, yeah.
It's a huge marketplace where they're all working together.
(Aaron) Is there anything based on the way that it's deployed,
whether it's EMOTET or Ursnif, or phishing,
or drive-by download that points toward specific targeting or specific groups,
or is it kind of just unknown at this point?
(Tyler) You know, I don't know if it's unknown.
I think there are a lot of organizations that have some pretty
in-depth threat intelligence that could go into it.
To say for sure though, I think it's always hard to say,
whether or not you're dealing with multiple groups
or if there's targeting going on.
For the most part though with TrickBot,
I've personally seen it on a number of different organizations.
There's no one vertical that they seem to be targeting,
it's all just wherever they can get installed onto,
they're going to see where they're at and if it's someplace good,
they may stay on there for a little bit longer and
grab some more information out.
If it's someplace smaller,
then they may move pretty quickly to their last stage of ransomware.
(Aaron) Right, so the main idea is to get on the systems wherever they can,
kind of shotgun method, see what information they get,
sell that information, and then potentially sell that access and move on.
(Tyler) Right.
They're probably going to act differently if they get on to,
let's say, a major bank versus some small mom and pop shop.
(Aaron) Yeah, that makes sense.
Absolutely.
And we were talking a little bit about this at dinner and
that once these deployments are done,
at some point it's turned over to a manual process?
So it's not all automatic.
At some point there's some sort of trigger for whoever's behind that infection,
that kind of get on keyboard and start looking around.
(Tyler) Yeah, well,
there's a lot of automation within TrickBot and there's lots of
new capabilities always coming out for TrickBot.
It seems like almost every week,
some security researcher finds a new module for
TrickBot that can do additional things.
At some point from what we've seen, it definitely turns into a manual process.
You know, PowerShell Empire, for the most part, is manual.
You have to be there, somebody's behind the keyboard typing commands.
In some of the investigations that I've done where
ransomware has been deployed from TrickBot,
we've actually seen attackers from TrickBot compromise systems,
RDP into non-TrickBot compromised systems and copy over
malware and run it from the keyboard,
and we know that there's somebody at a keyboard just based
off of the forensic data that's involved.
So it definitely at some point is going to turn into a manual process,
it's not completely automated yet.
But again, if TrickBot is on there,
it's eventually going to lead to something else.
(Aaron) Got it.
And you talked about new modules being downloaded.
I know that recently TrickBot has kind of resurged,
I'm assuming there's a new software development cycle for
whoever's behind starting TrickBot.
And there's headlines saying hey, TrickBot steals 250 million new passwords,
or your email passwords,
so what was particularly new about that that enabled them to do that?
(Tyler) I think in that case what ended up happening was
TrickBot was actually using a secondary program,
it was downloading another program, I believe called TrickBooster,
which would go and it would specifically look for things
like email passwords beyond what some of the capabilities
that TrickBot already has in it.
And so those are being exfiltrated to some place on the internet,
and then the security researchers found this database that
contained 250 million email credentials which they were
able to trace back to that.
(Aaron) Wow, yeah.
So, with this new capability,
I guess whoever had either already owned a large network of TrickBot
infections redeployed that module and got more emails,
as well as kind of more motivation to go ahead and infect additional systems?
(Tyler) Right, or who knows,
the developers behind TrickBot could have sold their services
to somebody who wanted them to get this,
and so they created a new program for it.
So regardless,
TrickBot was definitely a key part of this in order to get
all of these different email credentials.
(Aaron) So you're not really safe just through anonymity or because you
don't feel like you have anything that anybody wants.
This is more of anyone who's connected to the internet and
is using it for business functions is, or not,
even just private computers are going to be vulnerable to this.
(Tyler) Yeah.
Anybody, if you're running Windows,
TrickBot will be more than happy to infect you no matter who you are.