Login

Register

Login

Register

#cybersecurity | hacker | TrickBot banking trojan introduces RDP brute forcing module


Malicious actors have created a new module for the TrickBot banking trojan that allows the malware to perform brute force attacks on Microsoft’s Remote Desktop Protocol, specifically targeting U.S. and Hong Kong IP addresses.

The module, called rdpScanDll, primarily focuses on the telecommunications, education, and financial services sectors, according to a new white paper from Bitdefender’s Cyber Threat Intelligence Lab, authored by researcher Radu Tudorica and co-authored by team leader Alexandru Maximciuc and senior team leader Cristina Vatamanu.

Discovered on Jan. 30, rdpScanDll is still in development — in fact, researchers studying a sample of the module found that one of its attack modes was broken. But even so, the module adds even more functionality to TrickBot’s diverse arsenal of cyber weapons.

The trojan’s original purpose was for harvesting banking credentials, but thanks to its plug-in nature it can now also incorporate modules for a variety of purposes including lateral movement, reconnaissance, data collection and exfiltration and more. In its new paper, Bitdefender reports that plug-ins enabling lateral movement were the most frequently updated category of TrickBot modules over the last six months.

TrickBot is currently distributed largely via spam by the Emotet botnet, and has been recently used in campaigns in conjunction with Ryuk ransomware.

“The new rdpScanDll module may be the latest in a long line of modules that have been used by the TrickBot Trojan, but it’s one that stands out because of its use of a highly specific list of IP addresses,” the white paper states. “While the module seems to be under development, as one attack mode seems broken, newer versions of rdpScanDll will likely fix this and potentially add new ones.”



Original Source link

Leave a Reply

Shqip Shqip አማርኛ አማርኛ العربية العربية English English Français Français Deutsch Deutsch Português Português Русский Русский Español Español

National Cyber Security Consulting App

 https://apps.apple.com/us/app/id1521390354

https://play.google.com/store/apps/details?id=nationalcybersecuritycom.wpapp


NATIONAL CYBER SECURITY RADIO
[spreaker type=player resource="show_id=4560538" width="100%" height="550px" theme="light" playlist="show" playlist-continuous="true" autoplay="false" live-autoplay="false" chapters-image="true" episode-image-position="left" hide-logo="false" hide-likes="false" hide-comments="false" hide-sharing="false" hide-download="true"]
HACKER FOR HIRE MURDERS
 [spreaker type=player resource="show_id=4569966" width="100%" height="350px" theme="light" playlist="show" playlist-continuous="true" autoplay="false" live-autoplay="false" chapters-image="true" episode-image-position="left" hide-logo="false" hide-likes="false" hide-comments="false" hide-sharing="false" hide-download="true"]

ALEXA “OPEN NATIONAL CYBER SECURITY RADIO”

National Cyber Security Radio (Podcast) is now available for Alexa.  If you don't have an Alexa device, you can download the Alexa App for free for Google and Apple devices.   

nationalcybersecurity.com

FREE
VIEW