TrickBot
Software · ATTACK:enterprise:S0266
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0266",
"title": "TrickBot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0266",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--00806466-754d-44ea-ad6f-0caf59cb8556",
"external_id": "S0266",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2024-04-10T22:28:21.746Z",
"version": "2.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TrickBot"
},
{
"source_name": "TSPY_TRICKLOAD"
},
{
"source_name": "Totbrick"
},
{
"source_name": "Trend Micro Totbrick Oct 2016",
"url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n"
},
{
"source_name": "IBM TrickBot Nov 2016",
"url": "https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/"
},
{
"source_name": "TrendMicro Trickbot Feb 2019",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
},
{
"source_name": "Microsoft Totbrick Oct 2017",
"url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Totbrick"
},
{
"source_name": "Fidelis TrickBot Oct 2016",
"url": "https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"
},
{
"source_name": "S2 Grupo TrickBot June 2017",
"url": "https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"
}
]
}Explicit source assertions (57)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be
S2 Grupo TrickBot June 2017 · Fidelis TrickBot Oct 2016 · Cyberreason Anchor December 2019 · Eclypsium Trickboot December 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0266
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e03773-7cea-4b40-bf96-f22ccbc7187f
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03251067-ee3a-49e4-addc-86daaa8a3203
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17525c42-6859-4175-841c-272e85f68be9
ESET Trickbot Oct 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17ce446f-1a76-46d5-a276-589713425af8
S2 Grupo TrickBot June 2017 · Trend Micro Totbrick Oct 2016 · Microsoft Totbrick Oct 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1542.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20adc21a-7721-470f-82d4-8a4cfb59a8c1
Eclypsium Trickboot December 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20cf444d-b538-4971-b054-3d749aa945f0
Fidelis TrickBot Oct 2016 · IBM TrickBot Nov 2016 · Microsoft Totbrick Oct 2017 · Trend Micro Trickbot Nov 2018ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0266
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--239a4ed5-afe6-4d1d-8dfe-ee4df7bc01ba
IBM TA505 April 2020 · Proofpoint TA505 Sep 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2af126e3-89ef-45b4-b345-45567ef17dfa
S2 Grupo TrickBot June 2017 · Joe Sec TrickbotATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a26d78f-e0cb-4a58-8d84-6d867b32f279
Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ed5a1c3-e7c8-4fb7-bfcf-401b29f5f47c
Cyberreason Anchor December 2019 · Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fa8155d-11ca-47de-902e-47e809d0ed64
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1021.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42eb6018-f049-41df-bbfc-6dcb2f079f16
Trickbot VNC module July 2021 · Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ff492bf-f91d-445d-a29e-6e60c67a05c1
S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5235fbdb-5c53-4860-a459-cd4b538817db
Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ae4207c-95db-4a16-bfac-1d8daf29ba4a
S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b2f0fb3-5877-4fa2-bed1-1962423caccd
Trend Micro Trickbot Nov 2018 · Cyberreason Anchor December 2019 · TrendMicro Trickbot Feb 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b55eeb9-c7a1-4ff5-b8ef-f114e3a1b75a
TrendMicro Trickbot Feb 2019 · Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71bb09bc-0405-43ed-9848-bf685234c670
Fidelis TrickBot Oct 2016 · Bitdefender Trickbot C2 infra Nov 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76d7d7fa-94a4-4fa6-9fd2-e9af9ab0f356
S2 Grupo TrickBot June 2017 · Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cbc6309-f5fb-41e5-901b-67f02f29a834
ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d13961a-5fcc-4c97-aeda-f3e42325aabf
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dee0645-9c39-4e04-8012-6ae10a449ae9
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ecd1b78-a3f1-4997-be47-68377eb59689
S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--887d8bb3-1bd5-4010-81dc-fe479690e72d
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91cff72f-644b-42e3-9c86-8cc6475f725a
TrendMicro Trickbot Feb 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9af0d85e-688a-4dd7-a04e-a175e268855c
ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1087.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b5e38b3-31b5-4734-bef2-c05904479430
Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e07c247-c778-496d-9972-6581f2d10c93
Joe Sec TrickbotATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f372adb-777a-4635-9310-cbb8f432f08e
ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fb5ad4c-1929-4d00-bd87-fed2558d73bf
TrendMicro Trickbot Feb 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a50c7617-3148-4a0a-bf60-0c32171d6a9f
Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8126b8d-8dd7-4e12-a384-96dabb975725
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acece0c4-4c9e-4c11-a57a-f01bb23abbf7
Eclypsium Trickboot December 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af7c56df-ced8-45b7-9aef-be1039e30cea
Fidelis TrickBot Oct 2016 · Cyberreason Anchor December 2019 · Joe Sec TrickbotATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0bba4a5-a3c3-4cf7-9347-c9070cb18998
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b75e158b-3c2e-425d-a14e-84a974d86c8c
Trend Micro Totbrick Oct 2016 · Bitdefender Trickbot VNC module Whitepaper 2021 · Fidelis TrickBot Oct 2016 · S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc016a10-a594-495b-8822-ca054050f144
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c75ec383-2acd-479f-b9b7-b2038ec10a7d
Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c94a3ac7-1f05-460b-9bff-67fafd260e01
Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1110.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9932124-c6dd-4c26-a762-bde5be25bed7
ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--caef212a-7ed2-4cb9-a155-7ce79a9784b8
S2 Grupo TrickBot June 2017 · Trend Micro Trickbot Nov 2018ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1056.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce44b002-2ef5-4740-a39e-1e58c2817955
TrendMicro Trickbot Feb 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1f44e84-61cb-4a96-add8-d37a38369e43
S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8e0ed13-7938-4c9c-99ef-511b8dbf76aa
Trend Micro Totbrick Oct 2016 · Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc309013-0487-47fa-b514-71e18344a2db
Joe Sec TrickbotATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e014c5a8-f9bc-4de5-aa46-55765ac4461c
Bitdefender Trickbot C2 infra Nov 2020 · Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0ce4a5f-ac3b-4d61-b540-c5c3c434beb0
S2 Grupo TrickBot June 2017 · Trend Micro Totbrick Oct 2016 · Microsoft Totbrick Oct 2017 · Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e56f602c-ec9f-46f0-a52f-45b90220314e
ESET Trickbot Oct 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e83a16d0-70b7-415c-8b3f-bdbb89f10455
Emotet Deploys TrickBotATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e84c3f01-fb77-40e6-8507-42bc500bd928
ESET Trickbot Oct 2020ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e882b88e-7731-4bee-a644-c02f9aff2306
S2 Grupo TrickBot June 2017 · Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e922f65f-67ea-4df9-8b88-463d89b9120b
S2 Grupo TrickBot June 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0dd2703-4846-47b5-a8d8-471f70f9968e
Trend Micro Trickbot Nov 2018 · Cyberreason Anchor December 2019 · Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4d15148-3a41-4fbc-a42e-59379724acc5
Fortinet TrickBot · Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7bcd411-995f-41cb-b8ed-c333b0435ed3
S2 Grupo TrickBot June 2017 · Trend Micro Trickbot Nov 2018 · Cyberreason Anchor December 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb27a498-e1c1-47a4-a668-32c58c359f71
TrendMicro Trickbot Feb 2019