March 17, 2021 — The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have observed continued targeting through spear phishing campaigns using TrickBot malware in North America. A sophisticated group of cybercrime actors is luring victims, via phishing emails, with a traffic infringement phishing scheme to download TrickBot.
TrickBot—first identified in 2016—is a Trojan developed and operated by a sophisticated group of cybercrime actors. Originally designed as a banking Trojan to steal financial data, TrickBot has evolved into highly modular, multi-stage malware that provides its operators a full suite of tools to conduct a myriad of illegal cyber activities.
RELATED READING: NIST UPDATES YOU SHOULD BE AWARE ABOUT
To secure against TrickBot, CISA and FBI recommend implementing the mitigation measures described in this Joint Cybersecurity Advisory, which include blocking suspicious Internet Protocol addresses, using antivirus software, and providing social engineering and phishing training to employees.
Here is the link to the advisory: https://us-cert.cisa.gov/ncas/alerts/aa21-076a
Click here for a full PDF version of this report, or cut & paste this URL in your browser:
https://us-cert.cisa.gov/sites/default/files/publications/AA21-076A-TrickBot_Malware_508.pdf
