The original delivery mechanism was not found, but likely to have been a malicious email based on previous known Trickbot campaigns. We believe if this attack had been allowed to continue, it would have ended in domain wide ransomware, specifically Ryuk. They used PowerShell, SMB, and WMI to move laterally.ДЄfter acquiring the necessary credentials, the threat actors used a technique called Overpass-the-hash to move to a backup server, before being kicked off the network. They used tools such as AdFind, Nltest, Net, Bloodhound, and PowerView to peruse the domain, looking for high privileged credentials to accomplish their mission. The Trickbot threat actors used Cobalt Strike to pivot through-out the domain, dumping lsass and ntds.dit as they went. In our collection there was certainly a drop in overall Trickbot activity, but since the October disruption, we have seen it begin to rise again this is a recent intrusion from late December. While this did appear to have a short term effect on limiting the scope of the botnet operators, there have been reports on the limits of itsвЂ™ effectiveness.

At the same time, Microsoft along with other partners, secured court orders to take over and take down Trickbot command and control servers. The group was under concerted pressure applied by US Cyber Command infiltrating the botnet, and allegedly, providing alternate configuration files to break the botвЂ™s connections to the larger network.

In October of 2020, the group behind the infamous botnet known as Trickbot had a bad few days.

Cobalt strike beacon pth