Trickbot Group

The Trickbot Group, also known as ITG23, Wizard Spider, or DEV-0193, is a cybercriminal entity notorious for its malicious activities. This threat actor group has been linked to Russian intelligence services and primarily targets non-Russian entities, including financial institutions and hospitals, with ransomware campaigns. The group's operations were disrupted in the fall of 2020 through joint efforts by Cyber Command and Microsoft. However, Emotet, another cybercrime group, quickly moved to assist Trickbot's recovery by downloading Trickbot malware onto infected machines. The Trickbot Group has been under constant analysis by IBM Security X-Force researchers who have noted the group's use of several crypters. These crypters are developed by the group itself and are used to evade security product detection by abusing the trust of certificate authorities. The group uses signed loaders and malware, which are identified by a statically defined "gtag" that beacons to its Command & Control (C2) infrastructure. Notably, the group has replaced the BazarLoader backdoor with its own malware to gain initial access to a victim's infrastructure during ransomware attacks. Key members of the Trickbot Group include Sergey Loguntsov and Artem Kurov, who worked as developers, Vadym Valiakhmetov, a coder known by the online monikers Weldon, Mentos, and Vasm, and Maksim Rudenskiy, a team lead for coders. Additionally, Vladimir Dunaev, from Amur Oblast in the far east of Russia, was identified as an integral member of the criminal group. The U.S. Department of the Treasury and the U.S. Department of Justice have taken actions against these individuals, including sanctions and legal proceedings, for their involvement in the group's operations.