Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319

Blog

The Avengers of security teamed up to try and take down the TrickBot botnet

Image Description

The backend infrastructure of the TrickBot botnet has been disabled thanks to the work of Microsoft and a coalition of security firms and telecoms.

The software giant's Defender team worked together with FS-ISAC, ESET, Lumen's Black Lotus Labs, NTT and Broadcom's cybersecurity division Symantec to accomplish the feat which took months of preparation.

First spotted in 2016, TrickBot was initially a banking trojan that was a successor to Dyre before it evolved to perform a number of other malicious activities including spreading laterally through a network, stealing saved credentials in browsers, stealing cookies and infecting Linux machines.

The malware is usually delivered via email campaigns that leverage current events or financial lures in order to trick users into opening malicious file attachments or links to websites hosting malicious files. After infecting a system with TrickBot, cybercriminals then used it to install reconnaissance tools such as PowerShell Empire, Metasploit and Cobalt Strike to steal credentials and network configuration information.

Taking down TrickBot

In order to take down the TrickBot botnet, Microsoft, ESET, Symantec and other partners spent months collecting over 125,000 samples of the malware. They then analyzed these samples and extracted and mapped information about how the malware worked including the servers the botnet used to control infected computers.

After collecting this information on TrickBot's inner workings, Microsoft then went to the US District Court for the Eastern District of Virginia where the company asked a judge to grant it control over the botnet's servers. 

Corporate vice president of customer security and trust at Microsoft, Tom Burt provided further insight on how the company used the court's ruling to disable TrickBot's backend infrastructure in a blog post, saying:

“As we observed the infected computers connect to and receive instructions from command and control servers, we were able to identify the precise IP addresses of those servers. With this evidence, the court granted approval for Microsoft and our partners to disable the IP addresses, render the content stored on the command and control servers inaccessible, suspend all services to the botnet operators, and block any effort by the Trickbot operators to purchase or lease additional servers.”

While TrickBot appears to be out of commission for now, the botnet could return as other botnets have managed to survive similar takedown attempts in the past. Only time will tell if Microsoft and its partner's efforts were successful though even then, another botnet will likely rise up to take TrickBot's place.

Via ZDNet

Date

14 Oct 2020

Sources

Share

Other Blog

  • What is an ICO? Everything you need to know

    All your questions about ICOs, answered.

    Read More

  • Notebook shipments have dropped in May despite demand, IC shortage to blame

    Top five notebook manufacturers see a decline in shipments in May due to ongoing shortages in semiconductors.

    Read More

  • M2-powered MacBook Air and 13-inch MacBook Pro might land later this year

    With the Apple March event in the rearview mirror, we're all still waiting on a new MacBook Air and new MacBook Pro 13-inch, and a new report says we might have to wait for a good while longer.

    Many of us expected the two new MacBook models to make an appearance this week, so much so that the Mac Studio and Studio Display announcement caught a few of us by surprise. Unfortunately, a new report from 9to5Mac indicates that we might have to wait until later this year before we'll see the new devices.

    According to unnamed sources, the new MacBooks will feature the rumored M2 system-on-a-chip (SoC), which is codenamed J413 and referred to internally as "Staten." According to those sources, the SoC is based on Apple's A15 Bionic chip that powers the iPhone 13, though, obviously, it would be a scaled-up version of that processor in order to power a full-sized computer rather than a mobile device.

    These sources also indicate that the M2 will have the same 6-core CPU, but will have a slightly beefier 10-core GPU. That would give it two or three more GPU cores than the M1 (which comes in seven-core and eight-core GPU configurations) and there is no word yet on whether there would be an upgrade to the SoC's neural engine core count or any additional features it might introduce.

    The report also says that the M2 Pro, M2 Max, and M2 Ultra are also in the works and that the M2 Ultra would have a massive 24-core CPU, but these are likely too far in the future for us to even begin to speculate on.

    Analysis: take everything with a grain of salt

    As this author noted earlier this week, unnamed source reporting isn't always wrong, but it's impossible to distinguish between what is speculation and what is actual fact and until you get an official confirmation, you need to treat everything with skepticism.

    While there's no reason to doubt that 9to5Mac's sources are legit (they did break the news that the Mac Studio and Studio display were in the works), not all of the details in its exclusive were accurate. The Studio Display is not a 7K monitor but 5K, for example, and the Mac Studio and Studio Display weren't "in the works" with an eye towards a WWDC announcement, they were ready to go less than a week after the report was published.

    So, in short, these reports can be more or less on target, but we can't know until we see it confirmed, and even then it might only be partially legit. The problem is, we can't say which parts will pan out, and this is especially true of historically tight-lipped Apple. 

    We've gotten contradictory reports on whether the MacBook Pro and MacBook Air will get a redesign, whether they'll feature an M2 chip, and honestly, the release date rumors have been all over the map. There's a reason nearly everyone this week expected a 13-inch MacBook Pro announcement, at the very least, but we didn't see one.

    In the end, it's a fairly reasonable assumption that we will see a new MacBook Air at some point, possibly even this year. It's Apple's most popular computer, by far, and it is arguably the best laptop you can buy right now. We can't imagine a world where it is discontinued. But honestly, take even that assumption with a grain of salt. 

    If there's one thing we can definitively say about Apple it's that it loves making surprise announcements no one expected. It's a hell of a marketing strategy that's served it well in recent years, so we don't expect that to change any time soon.

    Read More

  • TalkTalk's super fast fibre broadband deal comes with low costs and £90 voucher

    Black Friday is rapidly approaching and, in the build-up, we're starting to see some really impressive broadband deals emerge. Right now, TalkTalk is offering a fantastic price - and freebie - on super fast fibre.

    You can currently pick up TalkTalk's Fibre 65 plan for only £22 a month. With this package, you're getting speeds averaging 67Mb while paying one of the cheapest fibre prices on the market.

    Those speeds will be more than plenty if you're currently working from home, gaming a lot, or simply have a house full of smart devices and multiple connections at one time. On top of the internet plan itself, you'll also get an £90 voucher with this deal. That can be spent at Amazon, Tesco, M&S or simply as an online-only Mastercard.

    TalkTalk's cheap fibre internet deal in full

    TalkTalk Fibre 65 Broadband: 18 months | Avg speeds 67Mb | FREE activation | £22 per month + £90 voucher
    Right now, TalkTalk's Fibre 65 broadband plan will only cost you £22 a month. Despite those low costs, you'll get speeds averaging 67Mb which is plenty for larger households with multiple devices connected at once. The £90 voucher is a nice extra touch, really helping this deal to stand out from the rest of the market.

    While it isn't the cheapest option for these speeds - that title goes to Vodafone's Superfast 2 plan - it isn't far off, only costing £1 more a month. Vodafone also lacks the free gift voucher that TalkTalk has and it will tie you in for a full 24 months compared to 18 with TalkTalk.

    Compared to brands like BT and Sky, TalkTalk is considerably more affordable. BT's closest package will cost you £29.99 a month (but does include a £90 Mastercard) and Sky's closest kicks in at £33 a month.

    see how this deal compares to the rest

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us