Trickbot Malware Family: IOCs, Detection, MITRE ATT&CK, Response

Overview

TrickBot is a trojan/spyware program written in C++ that, per MITRE ATT&CK, first emerged in September 2016 as a possible successor to Dyre. It was developed and initially used by the actor known as Wizard Spider to target banking sites in North America, Australia, and Europe, and has since been used worldwide across all sectors as part of 'big game hunting' ransomware campaigns. TrickBot is highly modular, supporting credential theft, network reconnaissance, and delivery of further payloads. It has frequently been paired with Emotet for initial access and preceded ransomware such as Ryuk and Conti.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Technique	Name	Tactic
`T1566.001`	Spearphishing Attachment
`T1055`	Process Injection
`T1053.005`	Scheduled Task
`T1071.001`	Web Protocols

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure.

Delivery vectors

Malspam with Excel macros
Emotet-delivered secondary payload
BazarLoader follow-on

Network indicators

HTTPS to C2 on ports 443, 447, 449
Self-signed certs with randomized CN

Persistence mechanisms

Scheduled task in \Microsoft\Windows path with legitimate-looking name
Service entry with random 8-char name

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TRICKBOT {
    meta:
        description = "Detects Trickbot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "trickbot" ascii wide nocase
        $s2 = "trickbot" ascii wide nocase
        $s3 = "totbrick" ascii wide nocase
        $s4 = "tspy_trickload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Trickbot Activity
id: d073f7352b82c1b8eedda381590adced
status: experimental
description: Detects generic indicators of the trickbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*trickbot*"
            - "*trickbot*"
            - "*totbrick*"
            - "*tspy_trickload*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

Isolate host immediately — TrickBot signals ransomware readiness
Reset domain credentials used on the host (treat as compromised)
Hunt across the domain for Cobalt Strike beacons
Audit Domain Controllers for AnchorDNS C2

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

Do not delay isolation — average dwell-to-ransomware time is under 48 hours
Do not assume reimage alone is sufficient without credential rotation
Do not skip threat hunt across other endpoints

Frequently Asked Questions

What is TrickBot?

A modular trojan/spyware first seen in September 2016, used for credential theft, network reconnaissance, and delivering additional malware.

Who created TrickBot?

MITRE attributes its development and early use to the actor tracked as Wizard Spider, originally for banking fraud.

Is TrickBot just a banking trojan?

It began focused on banking sites but evolved into a multipurpose toolkit used broadly, including as a precursor to ransomware.

How does TrickBot relate to ransomware?

It has been used in 'big game hunting' campaigns, providing the access later leveraged to deploy ransomware such as Ryuk and Conti.

How does TrickBot relate to Emotet?

Emotet has been documented as a downloader that delivers TrickBot, so the two were frequently seen together.

How does TrickBot get onto a machine?

Commonly through phishing emails and as a payload dropped by other malware like Emotet.

What was TrickBot's successor relationship to Dyre?

MITRE describes TrickBot as a possible successor to the earlier Dyre banking trojan.

How can organizations defend against TrickBot?

Block phishing, restrict macros, segment networks to limit lateral movement, monitor for credential theft, and maintain tested offline backups in case it leads to ransomware.

Where is the authoritative reference?

MITRE ATT&CK's TrickBot entry (S0266), linked on this page.

Trickbot