ITG23

ITG23, also known as the Trickbot/Conti syndicate, is a significant threat actor that has been active since 2016 in the East European cybercrime arena. This group is renowned for its use of Reflective DLL Injection code in many of its crypters, with the presence of these crypters on a file sample being a strong indication of ITG23 involvement or partnership. In addition to this, ITG23 has adapted to the evolving ransomware economy through the creation of Conti ransomware-as-a-service (RaaS) and the deployment of BazarLoader and Trickbot payloads to establish a foothold for ransomware attacks. The group has also collaborated with other notable affiliates such as Hive0107 to distribute Trickbot and BazarLoader. Since late February 2023, former members of ITG23 have been observed using Dave Loader with Domino Backdoor during their campaigns. This suggests a level of collaboration between ITG23 and other groups, possibly including current or former ITG14 developers. These campaigns may be delivered by threat actors using the handles ‘Netwalker’ and ‘Cherry,’ who are believed to be working within the ITG23 organization. However, it remains unclear whether ITG23 itself controls the delivery of these malicious emails or if they are independently distributed by other affiliates like Hive0106 and Hive0107. Significantly, ITG23 has formed partnerships with spam powerhouse Hive0106, also known as TA551, and consistently effective payload distributor Hive0105. During the summer, ITG23 partnered with Hive0107 to distribute Trickbot and BazarLoader. Furthermore, ITG23 operatives are reportedly collaborating with the threat actor Zeus on matters related to these campaigns, which might explain the derivation of 'zev,' 'zem,' and 'zvs' gtag names. Notably, some IBM researchers have identified files delivering malware unrelated to ITG23, such as the Zeppelin ransomware, indicating a complex and evolving threat landscape.