National Cyber Security Centre
How organisations can protect their networks from the ‘Trickbot’ banking trojan.
What is Trickbot?
Trickbot is an established banking trojan used in cyber attacks against businesses and individuals in the UK and overseas. Trickbot attacks are designed to access online accounts, including bank accounts, in order to obtain personally identifiable information (PII). Criminals use PII to commit identity fraud.
In some cases, Trickbot is used to infiltrate a network. Once inside it can be used to deploy other malware, including ransomware and post-exploitation toolkits.
Trickbot targets victims with well-crafted phishing emails, designed to appear as though sent from trusted commercial or government brands. These emails will often contain an attachment (or link to an attachment) which victims are instructed to open, leading to their machine being exploited.
What can Trickbot do?
Trickbot can download new capabilities onto a victim’s device (as well as updating those it has already deployed) without interaction from the victim.
- steal sensitive information, including banking login details and memorable information
- gather detailed information about infected devices and networks
- steal saved online account passwords, cookies and web history
- steal login credentials for infected devices, including domain credentials
- connect infected devices to malicious, criminally-controlled networks over the internet, giving criminals full control of them
- spread across a victim’s network by infecting other devices, including those on trusted domains (known as lateral movement), often using SMB shares
- download further malicious files such as Remote Access Tools, VNC clients and ransomware
Dealing with a possible Trickbot infection
Victims of Trickbot have observed a number of malicious activities, including:
- unauthorised access attempts to online accounts
- successful, fraudulent bank transfer activity
- unauthorised changes to their network infrastructure
To protect business and personal banking facilities (including where employees have accessed personal banking from work devices) you should:
- consider changing passwords and memorable information for any corporate, business or personal internet banking facilities (or other online resources) accessed from the infected network
- review bank and credit card statements for suspicious activity, and report any findings to your bank
- advise any employees who have accessed online banking facilities from the affected network to do likewise
If you (or your employees) have been the victim of fraud, report it to Action Fraud.
Protective action to take now
Run a full scan on all devices using up-to-date antivirus software, such as Windows Defender. This should detect and remove any Trickbot infection.
- Use the latest supported versions of operating systems and software, apply security patches promptly, use antivirus and scan regularly to guard against known malware threats.
- Keep antivirus software up to date, and consider the use of a cloud-backed antivirus product that can benefit from the improved threat intelligence and advanced analysis which large scale operations bring. Ensure that antivirus software is capable of scanning MS Office macros.
- Make sure important data is stored in an offline backup, to reduce the impact of ransomware.
- Use multi-factor authentication (MFA), also known as two-step verification or 2-factor authentication (2FA).
- Prevent and detect lateral movement in your enterprise networks.
- Implement architectural controls for network segregation. This would help mitigate the exposure of the SMB issues described above.
- Set up a security monitoring capability so you can collect the data needed to analyse network intrusions.
- If supported by your operating environment, consider whitelisting permitted applications. This will help prevent malicious applications from running.
Latest News from
National Cyber Security Centre
UK and US call out Russia for SolarWinds compromise16/04/2021 10:10:10
Russia’s Foreign Intelligence Service (SVR) responsible for intrusion of global software supplier.
Security updates released for Microsoft Exchange Servers14/04/2021 10:20:00
The NCSC is encouraging organisations to install critical updates following a number of vulnerabilities being addressed in Microsoft Exchange.
GCHQ reflects on the passing of His Royal Highness The Prince Philip, The Duke of Edinburgh13/04/2021 11:10:00
GCHQ and the NCSC reflect on the passing of HRH The Duke of Edinburgh.
Paws-word change recommended on National Pet Day09/04/2021 14:15:00
Ahead of National Pet Day, the NCSC is encouraging people to use three random words for passwords rather than the names of their pets.
More Master's degrees at UK universities recognised by cyber security experts09/04/2021 11:15:00
Ten universities around the UK have received official recognition for their postgraduate degrees in cyber security.
CYBERUK: flagship event set to take place in fully digital format02/04/2021 10:15:00
UK government’s cyber security event to be held virtually on 11-12 May giving the widest audience chance to participate.
New NCSC CEO warns against complacency while outlining future cyber risks29/03/2021 14:48:00
Wide-ranging speech from Lindy Cameron outlines the NCSC’s key successes so far, as well as recognising new challenges and developing threats the organisation faces.
New NCSC CEO to deliver first major speech in the role this morning26/03/2021 14:15:00
Lindy Cameron will speak to a virtual audience at Queen’s University, Belfast, today.