Huis » Nieuws » Banking Trojan TrickBot geleerd om spam en heeft reeds verzamelde 250 miljoen e-mailadressen

Banking Trojan TrickBot geleerd om spam en heeft reeds verzamelde 250 miljoen e-mailadressen

Malicious program TrickBot, designed to steal credentials and contacts of victims, received an additional module “TrickBooster”.

This module allows sending malicious emails on behalf of an infected user.

“TrickBooster gives TrickBot a highly-effective way to spread infection. By sending emails from trusted addresses within an organization TrickBot increases the odds that a would-be victim will open one of its trojanized attachments”, - schrijft Forbes IS reviewer Lee Mathews.

Tegelijkertijd, TrickBot acts very carefullyafter sending letters, the malware removes them from the “verzonden” map. By doing this, he manages to avoid detection.

onderzoekers van Deep Instinct, who discovered servers associated with TrickBot spam campaigns, claim that to date, malware operators have managed to collect more than 250 miljoen email addresses.

Among them is considerable amount of Gmail, Yahoo en Hotmail mailboxes, but there are also several emails owned by governmental agencies.

“U.S.-based accounts caught up in TrickBot’s web include staff from the Department of Justice, Department of State, Homeland Security, the Postal Service, as well as the FAA, ATF, IRS and NASA. Email accounts belonging to numerous Canadian and British agencies were also found in the database”, — reported Deep Instinct specialists.

If the user’s computer is already infected with TrickBot, the malware can download the TrickBooster component separately. Daarna, malware will send a list of victim’s contacts to attackers.

Referentie:

In de kern, TrickBot is a banking Trojan. The malware is typically distributed via spearphishing emailslike bogus resumes sent to human resources or invoices sent to accounts staff. Those are typically attached in the form of weaponized Microsoft Word or Excel files.

Over Trojan Killer

Carry Trojan Killer Portable op je memory stick. Zorg ervoor dat u in staat om uw pc te weerstaan ​​elke cyberdreigingen overal mee naar toe bent.

Controleer ook

MageCart op de Heroku Cloud Platform

Onderzoekers vonden verschillende MageCart Web Skimmers Op Heroku Cloud Platform

Researchers at Malwarebytes reported about finding several MageCart web skimmers on the Heroku cloud platform

Android Spyware CallerSpy

CallerSpy spyware maskers als een Android-chat-applicatie

Trend Micro experts discovered the malware CallerSpy, which masks as an Android chat application and, …

Laat een antwoord achter