On Oct. 12, armed with a court order, Microsoft and the Financial Services Information Sharing and Analysis Center (FS-ISAC) disconnected command-and-control (C2) servers at 19 different Internet addresses in an attempt to disrupt the Trickbot botnet, which has infected more than 1 million systems since 2016. They were not the only ones attacking the botnet, either. The takedown followed three weeks of disruptive operations against the Trickbot infrastructure reportedly carried out by US Cyber Command.
Yet the takedowns and disruptive operations had only a moderate impact on Trickbot. In early September, the botnet sent 4,000 to 5,000 messages per campaign using at least 37 C2 servers, according to security firm Proofpoint. In late September and early October, the number of C2 servers slowly decreased to a dozen, and since Oct. 12 the botnet has sent about 1,000 messages to a little more than 100 organizations, says Sherrod DeGrippo, senior director of threat research at Proofpoint.
"We don't know that the actors have necessarily made any additional hardening efforts against disruptions or takedowns, but given that the botnet was merely disrupted and not actually taken down, their current mitigations were at least somewhat effective," DeGrippo said.
The failure to taken down Trickbot for a significant duration demonstrates that cybercriminals have adopted significant countermeasures against defenders' tactics. By Oct. 15, for example, another operation had started a phishing campaign that aimed to install the modular banking Trojan Emotet on systems and then download and ..
Support the originator by clicking the read the rest link below.
