TrickBot Emerges with a Few New Tricks

This Zscaler ThreatLabZ report analyzes the TrickBot banking trojan (first seen 2016), detailing its common infection vectors (LNK/script/Office document downloaders), modular architecture and modules (credential stealing, lateral movement, VNC, RDP brute-force), C2 communication patterns (numeric IPs, SSL/TLS, specific request paths), operational relationships with other malware (Emotet, Ryuk, AnchorBot) and recent capability additions (rdpScanDll, Android MFA bypass), and recommends defensive actions such as SSL inspection and blocking known downloaders and C2 activity.