Trickbot indictment demonstrates how one hacking tool built on older malware

The episode exemplifies how cybercriminal groups can evolve and, drawing on old hacking tools, haunt U.S. organizations for years to come.

More than five years ago, Russian authorities reportedly raided a Moscow-based film company affiliated with the scammers behind Dyre, a notorious piece of malicious software linked with tens of millions of dollars in losses.

No charges against the hackers were made public, but scams using the Dyre banking trojans seemed to abruptly disappear.

A U.S. indictment unsealed last week confirmed what security researchers had long suspected: From the ashes of Dyre sprung TrickBot, a piece of malicious code that has caused untold financial costs by infecting tens of millions of computers worldwide and playing a part in a series of ransomware attacks. TrickBot rose to such prominence, and menace, that U.S. military hackers took aim at its infrastructure ahead of the 2020 election to reduce the potential for ransomware attacks that could disrupt the vote.

The episode exemplifies how cybercriminal groups can evolve and, drawing on old hacking tools, haunt U.S. organizations for years to come. And, as Joe Biden prepares to press Vladimir Putin on Russia-based ransomware gangs, the Dyre-TrickBot evolution offers another example of the long tail of lax law enforcement in Russia.

“It speaks to the resiliency of [organized cybercriminal] groups,” said Michael DeBolt, senior vice president for global intelligence at security firm Intel471. “The indictment illuminates the sheer scale and organization of the operation.”

The indictment charges Alla Witte, a 55-year-old Latvian woman, with writing computer code to deploy ransomware and collect extortion payments. She was arrested in February in Miami, and arraigned in federal court in Cleveland on Friday.

The raid was on a Moscow company called 25th Floor that produces movies in Russia and abroad. The company was then working on a cybercrime movie, called “Botnet,” that was loosely based on a 2010 cybercrime case that involved charges against dozens of people in the U.S., Reuters reported in 2016.

Whatever happened during the 2015 raid, DeBolt said, it disrupted the criminal enterprise behind Dyre and forced the scammers to recruit freelance hackers on multiple online forums. One of the recruits appears to be Witte, who maintained a website advertising her computer skills.

Nearly a year after the Russian raid, analysts at Fidelis Cybersecurity made direct links between Dyre and TrickBot, citing uncanny similarities in the code. But Hardik Modi, who was then a vice president at Fidelis, said it would have been difficult to foresee what a menace TrickBot would become.

“We knew [TrickBot] was a rampant at the time,” Modi said. But the malware’s transformation into a “gateway to ransomware” is its biggest impact on the cybersecurity landscape today, he added.

TrickBot gained notoriety when cybercriminals used the malware to assemble a vast botnet, or army of compromised computers. U.S. Cyber Command and tech companies sought to knock some of TrickBot’s infrastructure offline during the 2020 election season, but the botnet has lived on.

For now, Witte’s indictment is resulting in new findings about TrickBot itself.

“One interesting revelation in the indictment was that Witte [allegedly] developed a ransomware module for TrickBot itself,” said Katie Nickels, director of intelligence at cybersecurity company Red Canary.

“While cybersecurity researchers have tracked TrickBot for years — and it is widely known as a ‘precursor’ to Ryuk ransomware — there is little public research about the existence of a ransomware component of TrickBot,” Nickels added.

TrickBot will continue to be a menace to organizations, according to experts. And the indictment names more than a dozen other people known to the grand jury who are allegedly involved in TrickBot.

“There’s a reason why arresting people who are behind this is so difficult,” said DeBolt, of Intel471. “They make it difficult. And they know that’s one of the only ways you can put an end to these groups.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure