Trickbot Operators Now Selling Attack Tools to APT Actors

The operators of the prolific Trickbot banking botnet have begun offering advanced persistent threat actors access to a sophisticated new attack toolset called Anchor for exploiting the networks of high-value targets that the malware previously has compromised.

Researchers at security vendor SentinelOne's newly established SentinelLabs recently spotted North Korea's notorious state-backed Lazarus Group using the toolset to deploy one of its own malware samples on the network of an Anchor victim.

The discovery is significant because financially motivated crimeware operations like Trickbot so far mostly operated completely separately from APT campaigns — especially state-backed ones — that are typically more focused on data theft, surveillance, and other long-tailed activities.

"The maturity of the crimeware models and convergence of threats force us to rethink our defenses," says Vitali Kremez, lead cybersecurity researcher at SentinelLabs.

"Criminals and the nation-state are hunting for high-value targets and [collaborating] on their breach accesses," he says. Organizations now have to be concerned not just about criminal groups, but of crimeware threats that might mature into APT activity, Kremez notes.

Trickbot's operators, who started in 2016 by using the malware to steal money from online banking accounts, have over the years morphed into a massive crimeware-as-a-service operation. Trickbot itself has evolved from a tool for stealing bank account login information to a tool that can perform a variety of malicious functions — including delivering ransomware, banking Trojans, and cryptominers.

The operators of Trickbot have built a database of information on networks that they have compromised, which other attackers can access and use for a fee to deliver ransomware and carry out attacks of their own.

So far, Trickbot's crimeware-as-a-service offering has targeted mainly other financially motivated affiliates. But with the Anchor project, Trickbot's business model appears to have expanded, according to SentinelLabs.

"It was a separate hidden project and/or fork from the main Trickbot malware codebase," Kremez says. It appears to have been developed for high-value targets and intrusions and multiple APT groups are currently using it, he says. 

The Anchor attack framework includes tools ranging from a sophisticated malware installer to a clean-up tool for wiping clean all evidence of an attack. It includes mechanisms that allow attackers to load legitimate frameworks such as Metasploit, Cobalt Strike, and PowerShell Empire and use them for post-compromise exploitation, SentinelLabs said.

"Anchor presents as an all-in-one attack framework designed to compromise enterprise environments using both custom and existing toolage," the vendor noted. It gives APT actors a way to do targeted data-extraction and to remain undetected on compromised networks for a long time.

Mutually Beneficial

For an operation like the Lazarus Group, Trickbot's Anchor project is especially useful. The group, best known for its attacks on Sony as well as its abuse of the SWIFT financial network to steal tens of millions of dollars from the Bank of Bangadesh, is a somewhat rare APT threat actor. As an arm of the North Korean regime, the Lazarus Group is not just focused on data theft, but also on financially motivated attacks in support of the cash-starved government.

Some see the WannaCry ransomware attacks and the attacks via the SWIFT network as example of the group's efforts to raise money for the North Korean government.

For the Lazarus Group, the primary benefit of the Trickbot Anchor tie-up "is access to compromised high-value targets for further post-exploitation and monetization without the need to run their own campaign," Kremez says.

And the use of third-party tools such as those from Trickbot can also help make attribution harder for investigators.

SentinelLabs' research suggests a working relationship between Lazarus Group members and some of the criminals behind Trickbot Anchor, which allows them to have a mutually beneficial financial relationship, Kremez says. "We believe it might be a partnership agreement given our knowledge of how the groups operate in a very private protective manner," and only with the most trusted partners, he says.

APT groups are not the only focus, however. According to SentinelLabs, the Anchor attack toolset is also being used in large-scale cyber heists and attacks on point-of-sale systems.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security 101: What Is a Man-in-the-Middle Attack?"