Approximately two weeks ago, the U.S. military’s Cyber Command, under the National Security Agency (NSA), executed a coordinated attack on the Trickbot botnet. This attack included sending disconnect commands to computers infected with the Trickbot malware, and spoofing records, so the collection of target data has been muddied and compromised itself.
In an interview with KrebsOnSecurity, Alex Holden, CISO and President of Hold Security out of Milwaukee, stated that they had been watching Trickbot’s network for some time, including before and after the operation. According to Holden, the attack cut off the team behind Trickbot from many devices, but they can still rebuild. Moreover, the Trickbot team still has personal records of millions of people mixed in with the fake data. Even with the losses and setbacks, the Russian-speaking Trickbot team will possibly be increasing ransom prices to “recoup their losses.” As Holden puts it, “Normally, they will ask for [a ransom amount] that is something like 10 percent of the victim company’s annual revenues. Now, some of the guys involved are talking about increasing that to 100 percent or 150 percent.”
Overall, the U.S. Cyber Command is battling up a steep hill when fighting for cybersecurity. This is not the end of Trickbot nor the end of Cyber Command operations in red (OPFOR controlled) or grey (unknown/free) cyberspace. Similarly, this is likely not the end of an uptick in cybersecurity threats leading up to the election, so for further news about cybersecurity, keep an eye on HotHardware.
(Image Courtesy of Chief Petty Officer Dennis Herring)
This content was originally published here.