Threat Management, Malware

TrickBot banking trojan introduces RDP brute forcing module

Malicious actors have created a new module for the TrickBot banking trojan that allows the malware to perform brute force attacks on Microsoft's Remote Desktop Protocol, specifically targeting U.S. and Hong Kong IP addresses.

The module, called rdpScanDll, primarily focuses on the telecommunications, education, and financial services sectors, according to a new white paper from Bitdefender's Cyber Threat Intelligence Lab, authored by researcher Radu Tudorica and co-authored by team leader Alexandru Maximciuc and senior team leader Cristina Vatamanu.

Discovered on Jan. 30, rdpScanDll is still in development -- in fact, researchers studying a sample of the module found that one of its attack modes was broken. But even so, the module adds even more functionality to TrickBot's diverse arsenal of cyber weapons.

The trojan's original purpose was for harvesting banking credentials, but thanks to its plug-in nature it can now also incorporate modules for a variety of purposes including lateral movement, reconnaissance, data collection and exfiltration and more. In its new paper, Bitdefender reports that plug-ins enabling lateral movement were the most frequently updated category of TrickBot modules over the last six months.

TrickBot is currently distributed largely via spam by the Emotet botnet, and has been recently used in campaigns in conjunction with Ryuk ransomware.

"The new rdpScanDll module may be the latest in a long line of modules that have been used by the TrickBot Trojan, but it's one that stands out because of its use of a highly specific list of IP addresses," the white paper states. "While the module seems to be under development, as one attack mode seems broken, newer versions of rdpScanDll will likely fix this and potentially add new ones."

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.