Malicious actors have created a new module for the TrickBot banking trojan that allows the malware to perform brute force attacks on Microsoft’s Remote Desktop Protocol, specifically targeting U.S. and Hong Kong IP addresses.
The module, called rdpScanDll, primarily focuses on the telecommunications, education, and financial services sectors, according to a new white paper from Bitdefender’s Cyber Threat Intelligence Lab, authored by researcher Radu Tudorica and co-authored by team leader Alexandru Maximciuc and senior team leader Cristina Vatamanu.
Discovered on Jan. 30, rdpScanDll is still in development — in fact, researchers studying a sample of the module found that one of its attack modes was broken. But even so, the module adds even more functionality to TrickBot’s diverse arsenal of cyber weapons.
The trojan’s original purpose was for harvesting banking credentials, but thanks to its plug-in nature it can now also incorporate modules for a variety of purposes including lateral movement, reconnaissance, data collection and exfiltration and more. In its new paper, Bitdefender reports that plug-ins enabling lateral movement w ..
Support the originator by clicking the read the rest link below.
