Trickbot Group

The Trickbot Group, also known as ITG23, Wizard Spider, and DEV-0193, is a threat actor group notorious for its malicious activities. The group has been consistently analyzed by IBM Security X-Force researchers due to their development and use of several crypters. In the fall of 2020, efforts were made to disrupt Trickbot's operations, prompting Emotet to assist in ITG23’s recovery by downloading Trickbot malware to infected machines. Notably, each individual Trickbot sample beacons to its Command & Control (C2) infrastructure with a statically defined “gtag”, which is believed to act as an identifier for distinct Trickbot customers. Key members of the Trickbot group include Sergey Loguntsov, Artem Kurov, Vadym Valiakhmetov, and Maksim Rudenskiy, who served in roles ranging from developers to coders. Vladimir Dunaev, a Russian national from Amur Oblast, was also identified as an integral member of the criminal Trickbot group, which became infamous for its sophisticated information-stealing Trojan that defrauded innocent internet users for years. The group notoriously abuses the trust of certificate authorities by using signed loaders and malware to evade security product detection. In response to their activities, the U.S. Department of the Treasury sanctioned several individuals involved in management and procurement for the Trickbot group, citing their ties to Russian intelligence services. The group primarily targeted non-Russian entities, including financial institutions and hospitals, with ransomware campaigns. According to the U.S. Treasury Department, the group’s aims are aligned with those of the Russian government. The sanctioned individuals included administrators, managers, developers, and coders who have materially supported the operations of the Trickbot group.