The Patching Friars' AlmanacA calendar of CVE saints
TrickBotHoly card for d-trickbot, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 ?? TrickBot TRES CHARTAE MALAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle II · Legions (botnets)

The Demon TrickBot, Juggler of Wizard Spider

Legend

Appearing in 2016 from the Dyre lineage, TrickBot was a modular banking trojan that grew into a botnet and ransomware delivery platform for the Wizard Spider group, the people behind Ryuk and Conti, including attacks on US hospitals in 2020. In October 2020 Microsoft won a court order to take down part of its infrastructure, and by 2022 the operators had moved to other tools. In May 2024 what remained was also hit by Europol and Eurojust's Operation Endgame.

Exorcism

Cast it out by applying MS17-010 and switching off SMBv1. Block malspam attachments and hunt for droppers such as Emotet and BazarLoader that bring it in; protect credentials with LSASS protection and MFA, and segment the network.

Technical record

Also known as
Trickster, TrickLoader
Circle
Circle II · Legions (botnets) · Circle VI · Banking trojans and infostealers · Circle III · Ransomware and extortion
First seen
2016
Status
Exorcised (Microsoft court-ordered disruption, 2020-10-12)
Weapons (exploited CVEs)
Saint EternalBlue, Escaped From the Arsenal
Works
The Miracle of Operation Endgame

A modular banking trojan that emerged in 2016 from the Dyre lineage and became a botnet and ransomware delivery platform run by the Wizard Spider group, behind Ryuk and Conti. Microsoft led a court-ordered infrastructure disruption in October 2020, and the operators shifted to other tools by 2022.

Sources: attack.mitre.org · attack.mitre.org · europol.europa.eu · MITRE ATT&CK reference S0266

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.