TrickBot developers have spun up a new backdoor for high

Banking trojan operators are upping their game, researchers say.

The people behind banking trojan TrickBot have expanded the malware’s capability with a new backdoor meant to compromise high-value targets, according to new research from SentinelOne.

The update should cause alarm for the financial sector, since it can enable cybercriminals to infect systems undetected with malicious software, and then surreptitiously escalate their attack to pilfer off confidential banking information, or launch ransomware attacks, according to SentinelLabs, SentinelOne’s new threat intelligence division.

The new backdoor, which SentinelLabs calls “PowerTrick,” is likely launched through Windows management system PowerShell, which seems to indicate that the new fuction has been developed to reach intended victims while avoiding detection.

“‘PowerTrick’ is a flexible new tool that allows attackers to augment their access on the fly while still staying undetected, bypassing restrictions and security controls,” Vitali Kremez, who leads research at SentinelLabs, said in a blog post.

These findings are the latest addition to a growing body of research that details how scammers are using TrickBot, sometimes in coordination with other hacking tools, to make a buck, all while trying to stay ahead of corporate security teams.

Once PowerTrick has been installed on victim machines, it conducts an initial scan, waits for more commands and sends back results to hackers, according to SentinelLabs. It also uses functions from pen-testing framework Metasploit and other PowerShell tools to pivot to other systems and further obfuscate infection activities, according to SentinelLabs.

“Once the system and network have been profiled, the actors perform deletion operation and cleanup,” Kremez writes. “They remove any existing files that did not execute properly and move on to a different target of choice or perform lateral movement inside the environment to high-value systems such as financial gateways.”

It’s this transition to other systems that could be particularly damaging in the financial sector. TrickBot infections have recently begun focusing on exploiting critical assets and high value targets, such as point-of-sale systems, according to researchers.

One malware family, called Anchor, has established “targeted data extraction from secure environments” and “long-term persistency,” according to SentinelLabs.

TrickBot infections have also been linked with ransomware infections  and Bitcoin wallet theft.

“The TrickBot cybercrime enterprise actively develops many of its offensive tools such as ‘PowerTrick’ that are leveraged for stealthiness, persistence, and reconnaissance inside infected high-value targets such as financial institutions,” Kremez writes.

SentinelLabs did not detail any of the new backdoor’s victims or reveal how long PowerTrick has been operational.

It wasn’t immediately clear which threat actors might be taking advantage of the new backdoor, if any.

Correction: This article has been corrected to reflect the description of Metasploit.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure