TrickBot

Description

TrickBot is a modular banking trojan and malware loader that has been active since 2016, evolving from credential theft into the core of a major criminal ecosystem. Its module system added reconnaissance, lateral movement, and delivery capabilities, and it fed access and payloads to operations such as Ryuk and Conti. Repeated takedown efforts disrupted its infrastructure, yet rebuilt versions and successor tooling keep its tactics alive in modern campaigns.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

TotbrickTrickbot

MITRE ATT&CK techniques

55 techniques across 12 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File
T1559Inter-Process Communication
- T1559.001Component Object Model

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
T1036Masquerading
T1055Process Injection
- T1055.012Process Hollowing
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
T1542Pre-OS Boot
- T1542.003Bootkit
T1564Hide Artifacts
- T1564.003Hidden Window

TA0006 Credential Access

T1110Brute Force
- T1110.004Credential Stuffing
T1552Unsecured Credentials
- T1552.001Credentials In Files
- T1552.002Credentials in Registry
T1555Credentials from Password Stores
- T1555.005Password Managers
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1007System Service Discovery
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1069Permission Groups Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.001Local Account
- T1087.003Email Account
T1135Network Share Discovery
T1482Domain Trust Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.005VNC
T1210Exploitation of Remote Services

TA0009 Collection

T1005Data from Local System
T1056Input Capture
- T1056.004Credential API Hooking
T1185Browser Session Hijacking

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
- T1090.002External Proxy
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1219Remote Access Tools
T1571Non-Standard Port
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1495Firmware Corruption

TA0112 Defense Impairment

T1112Modify Registry
T1553Subvert Trust Controls
- T1553.002Code Signing
T1685Disable or Modify Tools

Associated groups

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Spyware.Trickbot	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.TrickBot	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
DeepScan:Generic.TrickBot.1832592A	AV
Document-Excel.Downloader.TrickBot	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Document-Office.Downloader.TrickBot	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Dump:Generic.TrickBot.1832592A	AV
Gen:Heur.Mint.Trickbot.1	AV
Gen:Heur.Trickbot.3	AV
Gen:Variant.Trickbot.18	AV
Gen:Variant.Trickbot.29	AV
Gen:Variant.TrickBot.40572	AV
Gen:Variant.TrickBot.40666	AV
Gen:Variant.Trickbot.82	AV
Gen:Variant.Trojan.TrickBot.1	AV
Generic.TrickBot.2.B39D3DFD	AV
Generic.TrickBot.2.E7DC68E2	AV
Generic.Trojan.TrickBot.41B29EF0	AV
Generic.Trojan.TrickBot.FA2E587A	AV
Linux.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Trojan.TrickBot.3	AV
Trojan.TrickBot.BS	AV
Trojan.Trickbot.U	AV
Win32.Downloader.TrickBot	ATP Sandbox Adv. Heuristics
Win32.Spyware.Trickbot	ATP Sandbox Adv. Heuristics
Win32.Spyware.TrickBot	ATP Sandbox Adv. Heuristics
Win32.Trojan.Totbrick	ATP Sandbox Adv. Heuristics
Win32.Trojan.Trickbot	ATP Sandbox Adv. Heuristics
Win32.Trojan.TrickBot	ATP Sandbox Adv. Heuristics
Win64.Spyware.TrickBot	ATP Sandbox Adv. Heuristics
Win64.Trojan.TrickBot	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.TrickBot outbound connection attempt	IPS-SWG
MALWARE-CNC Win.Trojan.Trickbot variant outbound connection	IPS-SWG
MALWARE-OTHER Win.Trojan.TrickBot malicious executable download attempt	IPS-SWG
MALWARE-TOOLS Win.Trojan.Trickbot Trickboot module download attempt	IPS-SWG