After evading law enforcement’s takedown attempts over the past four years, TrickBot’s days are now numbered as it will soon be replaced by the BazarBackdoor malware.
The reason being is that the top members of TrickBot have joined the Conti ransomware syndicate according to a new report from the cybercrime and adversarial disruption firm Advanced Intelligence (AdvIntel).
For those unfamiliar, TrickBot is a Windows malware platform that utilizes multiple modules to conduct a variety of malicious activities such as information and password stealing, infiltrating Windows domains, gaining access to corporate networks and delivering malware. The developers of TrickBot have partnered with ransomware gangs to take over and infect millions of devices around the world since 2016.
While the Ryuk ransomware gang first partnered with TrickBot to gain access to its technology, the group was replaced by the Conti ransomware gang which has been using its malware over the course of the past year to gain access to corporate networks. According to AdvIntel, the group that managed the various TrickBot campaigns is an elite division of cybercriminals known as Overdose which has brought in at least $200m from its nefarious activities online.
Under new management
Last year security researchers at AdvIntel noticed that Conti had become the only user of TrickBot’s botnet product. By the end of 2021 though, Conti had essentially acquired TrickBot with multiple elite developers and managers joining the ransomware gang.
What sets Conti apart from other ransomware gangs is that it uses a “trust-based, team-based” model as opposed to working with random affiliates. As a result, the group has been better at evading law enforcement than many of its peers.
Going forward, the Conti ransomware group plans to use TrickBot’s newer product, the BazarBackdoor malware, as it is stealthier and harder to detect. Although BazarBackdoor used to be a part of TrickBot’s larger toolkit, it has since become its own fully autonomous tool according to AdvIntel.
While the TrickBot malware’s day in the sun may be over, the Conti ransomware group will continue to target businesses using BazarBackdoor. At the same time, the former leaders of TrickBot are now operating under Conti’s direction and the group will likely use their talents to launch even more attack campaigns.
Via BleepingComputer
