June 2, 2020 By David Bisson 2 min read

Security researchers observed the Trickbot operators using a new backdoor called “BazarBackdoor” to gain full access to targeted networks.

Panda Security explained that Trickbot’s attempts to deliver BazarBackdoor began with a spear phishing campaign. That operation’s attack emails leveraged employee termination notices, customer complaints and other themes to trick recipients into clicking on a link for a file hosted on Google Docs. The links redirected victims to a website that informed the recipient that they needed to download the file directly in order to view it correctly.

When downloaded, the documents ran hidden executable code to call a loader. This asset remained quiet for a time before connecting with a command-and-control (C&C) server for the purpose of downloading BazarBackdoor. This malware shared parts of the same code along with delivery and operation methods employed by Trickbot, similarities that led Panda Security to speculate that the same actors were responsible for developing both threats.

Trickbot’s Activity Involving Other Backdoors

BazarBackdoor didn’t mark the first time that Trickbot has leveraged a backdoor in its attack efforts. Back in April 2019, Cybereason detected an attack campaign in which Emotet loaded Trickbot as a means to deploy Ryuk ransomware. In that attack, Trickbot used its reverse shell module, “dll.dll,” to perform reconnaissance so that it could eventually launch the Empire backdoor. In January 2020, Sentinel Labs observed Trickbot using “PowerTrick,” a backdoor that helped the malware conduct reconnaissance of and remain persistent on the networks of targeted financial institutions.

Defend Against BazarBackdoor

Security professionals can help defend their organizations against phishing attacks carrying BazarBackdoor by making sure that there’s an incident response (IR) plan in place that provides guidance on how to remediate a successful phishing attack. Having a plan is not enough; teams should also regularly test this strategy to ensure the plan works ahead of an attack. Additionally, infosec personnel should leverage ongoing phishing simulations to strengthen their employees’ defenses against email attacks.

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today