{
  "family": "trickbot",
  "sample_count": 466,
  "category": "trojan",
  "description": "TrickBot is a trojan/spyware program written in C++ that, per MITRE ATT&CK, first emerged in September 2016 as a possible successor to Dyre. It was developed and initially used by the actor known as Wizard Spider to target banking sites in North America, Australia, and Europe, and has since been used worldwide across all sectors as part of 'big game hunting' ransomware campaigns. TrickBot is highly modular, supporting credential theft, network reconnaissance, and delivery of further payloads. It has frequently been paired with Emotet for initial access and preceded ransomware such as Ryuk and Conti.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "TrickBot",
    "Totbrick",
    "TSPY_TRICKLOAD"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrickBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A modular trojan/spyware first seen in September 2016, used for credential theft, network reconnaissance, and delivering additional malware."
      }
    },
    {
      "@type": "Question",
      "name": "Who created TrickBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE attributes its development and early use to the actor tracked as Wizard Spider, originally for banking fraud."
      }
    },
    {
      "@type": "Question",
      "name": "Is TrickBot just a banking trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It began focused on banking sites but evolved into a multipurpose toolkit used broadly, including as a precursor to ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How does TrickBot relate to ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It has been used in 'big game hunting' campaigns, providing the access later leveraged to deploy ransomware such as Ryuk and Conti."
      }
    },
    {
      "@type": "Question",
      "name": "How does TrickBot relate to Emotet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Emotet has been documented as a downloader that delivers TrickBot, so the two were frequently seen together."
      }
    },
    {
      "@type": "Question",
      "name": "How does TrickBot get onto a machine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Commonly through phishing emails and as a payload dropped by other malware like Emotet."
      }
    },
    {
      "@type": "Question",
      "name": "What was TrickBot's successor relationship to Dyre?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE describes TrickBot as a possible successor to the earlier Dyre banking trojan."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations defend against TrickBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block phishing, restrict macros, segment networks to limit lateral movement, monitor for credential theft, and maintain tested offline backups in case it leads to ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's TrickBot entry (S0266), linked on this page."
      }
    }
  ],
  "faq_count": 9,
  "mitre_attack": [
    "T1566.001",
    "T1547.001",
    "T1021.002",
    "T1210",
    "T1555.003",
    "T1486",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "overview_short": "TrickBot is a modular banking trojan and access broker that evolved into a key precursor for Ryuk and Conti ransomware. Microsoft and US Cyber Command disrupted its infrastructure in October 2020; affiliates have since migrated to other loaders.",
  "first_seen": "2016",
  "status": "largely_disrupted",
  "iocs": {
    "delivery": [
      "Malspam with Excel macros",
      "Emotet-delivered secondary payload",
      "BazarLoader follow-on"
    ],
    "network": [
      "HTTPS to C2 on ports 443, 447, 449",
      "Self-signed certs with randomized CN"
    ],
    "persistence": [
      "Scheduled task in \\Microsoft\\Windows path with legitimate-looking name",
      "Service entry with random 8-char name"
    ]
  },
  "detection": [
    "YARA rules from CISA AA21-076A",
    "Suricata rules for TrickBot module download URIs (/images/ pattern)",
    "EDR rule for svchost.exe spawned from non-services.exe parent"
  ],
  "containment_steps": [
    "Isolate host immediately — TrickBot signals ransomware readiness",
    "Reset domain credentials used on the host (treat as compromised)",
    "Hunt across the domain for Cobalt Strike beacons",
    "Audit Domain Controllers for AnchorDNS C2"
  ],
  "what_to_avoid": [
    "Do not delay isolation — average dwell-to-ransomware time is under 48 hours",
    "Do not assume reimage alone is sufficient without credential rotation",
    "Do not skip threat hunt across other endpoints"
  ],
  "references": [
    {
      "title": "CISA Alert AA21-076A: TrickBot Malware",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-076a"
    },
    {
      "title": "Microsoft: An update on disruption of Trickbot",
      "url": "https://blogs.microsoft.com/on-the-issues/2020/10/20/trickbot-ransomware-disruption-update/"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment"
    },
    {
      "id": "T1055",
      "name": "Process Injection"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols"
    }
  ],
  "sources": [
    {
      "name": "MITRE ATT&CK: TrickBot (S0266)",
      "url": "https://attack.mitre.org/software/S0266"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0266",
  "threat_actors": [
    "Wizard Spider"
  ],
  "target_industries": [
    "Financial Services"
  ],
  "target_geographies": [
    "North America",
    "EMEA"
  ],
  "motivation": "Financial Extortion"
}