Remote Access Credentials Are the Latest Malware Attack Target


The latest iteration of notable banking trojan, Trickbot, now includes a password grabbing module designed to provide cybercriminals with remote access to internal systems.

One of the goals of any attacker intent on moving laterally within your network is to first gain access to an endpoint. A new variant of Trickbot is making this easier for cybercriminals by automatically grabbing credentials from three well-known remote access solutions. It should be noted this is a update to the passwordgrabber that has been seen in the wild in Trickbot, which has been known to grab passwords from Microsoft Outlook and a slew of popular web browsers.

But, it’s this latest version that takes password grabbing to the next level. According to a deep dive article from AV vendor, TrendMicro, Trickbot’s newest version of the password grabber subroutine grabs passwords from Virtual Network Computing (VNC), PuTTY, and Microsoft’s Remote Desktop Protocol (RDP) connections.

We’ve seen a focus by cybercriminals on remote desktop credentials in the past – from ransomware variants offering to decrypt in exchange for credentials, to paying for credentials outright on the dark web. So, this new trojan is particularly disturbing.

Organizations need to realize the potential damage that can be done when a cybercriminal has complete unfettered access to the desktop of one or more of your endpoints. The need to stop all malware (including these kinds of trojans) is critical.

The most effective way to stop malware infection is through Security Awareness Training.Leveraging the user as part of your security strategy, this training elevates the user’s understanding of malware-based attacks, how they are delivered, and how to spot suspicious links and attachments before becoming a victim. 

Are your users putting a big target on your organization's back?

Verizon's recent Data Breach Report showed that 81% of hacking-related breaches used either stolen or weak passwords. And, a new survey from Dark Reading shows 44% of organizations say users pose the greatest threat to data security!

KnowBe4's Password Exposure Test (PET) makes it easy for you to identify users with exposed emails publicly available on the web, and checks your Active Directory to see if they are using weak or compromised passwords that are part of a known data breach. PET then reports on any user accounts affected so you can take action immediately!

PETHere's how the Password Exposure Check works:

  • Checks to see if any of your organization's email addresses have been part of a data breach
  • Tests against 10 types of weak password related threats associated with user accounts
  • Checks against breached or weak passwords currently in use in your Active Directory
  • Reports on the accounts affected and does not show/report on the actual passwords 
  • Just download the install, run it, get results in minutes!

Download Now

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

New call-to-action

Get the latest about social engineering

Subscribe to CyberheistNews