Malicious actors have created a new module for the TrickBot banking trojan that allows the malware to perform brute force attacks on Microsoft's Remote Desktop Protocol, specifically targeting U.S. and Hong Kong IP addresses.
The module, called rdpScanDll, primarily focuses on the telecommunications, education, and financial services sectors, according to a new white paper from Bitdefender's Cyber Threat Intelligence Lab, authored by researcher Radu Tudorica and co-authored by team leader Alexandru Maximciuc and senior team leader Cristina Vatamanu.
Discovered on Jan. 30, rdpScanDll is still in development -- in fact, researchers studying a sample of the module found that one of its attack modes was broken. But even so, the module adds even more functionality to TrickBot's diverse arsenal of cyber weapons.
Please register to continue.
Already registered? Log in.
Once you register, you'll receive:
The context and insight you need to stay abreast of the most important developments in cybersecurity. CISO and practitioner perspectives; strategy and tactics; solutions and innovation; policy and regulation.
Unlimited access to nearly 20 years of SC Media industry analysis and news-you-can-use.
SC Media’s essential morning briefing for cybersecurity professionals.
One-click access to our extensive program of virtual events, with convenient calendar reminders and ability to earn CISSP credits.