TrickBot malware evolved from a 2016 banking trojan into a loader for ransomware and other attacks. Its newest alleged capability, TrickBoot, targets system firmware below the OS, making it invisible to traditional security tools and able to survive OS reinstalls. If successful, it would force a major shift in how cybersecurity defends against threats.
Chapters
There are some dangerous things going on with malware evolution, and it's important to understand this. TrickBot, which is a well-known piece of malware that's been around since 2016, well, it has a new trick. And the authors of this particular piece of malware are constantly innovating, and they're very, very persistent. They're considered top tier, if you will. And Microsoft has gone after them. Governments have gone after them to try and shut down their botnets and shut down their capabilities, and they've persisted. And through that, they've continually innovated as well. And the latest capability that they have that researchers think that they're able to do is potentially attack the firmware. Now that's huge. All right, and let me explain why. Think of a computer as really kind of a stack of capabilities. You know, at the top you've got data and then applications beneath that, and beneath that you've got the operating system and maybe some virtualization and VMs underneath that, and then you have the firmware and finally the hardware. So it— the firmware is very, very low in that stack. And the thing is, no matter where you are in that stack, stack, you can see things going on above you, but you can't see things going on below you. So anti-malware software typically has hooks in the operating system, so it can see what's going on in the operating system as well as any applications on top of that. But if you get below that, like in the firmware, you can't see it. So TrickBot and its new capabilities, which is being dubbed TrickBoot, is targeting that firmware, and that should be of grave concern because if they're able to actually pull this off— and it isn't easy, by the way— but if they are able to pull this off and get inside and, and compromise that firmware, they really get 3 big benefits. The first one is stealth. Again, the normal security tools can't reach down in there, can't see what's going on in the firmware. So if you're able to get in there and reside there, it's almost impossible to detect, especially with current tools. So that's the first thing. The second thing is persistence. Once you get in there and you're able to control some of those, you know, EEPROMs and other structures that make it very, very persistent it's really tough to get somebody out of there. In fact, chances are if they do it right, you're gonna just trash— you're gonna pull the whole motherboard. It doesn't even make sense to pull the, the firmware, the chips. You're just gonna scrap the whole thing and you're gonna slap a new motherboard in and rebuild the entire device, the server or the PC. So evicting somebody that has been detected, also really difficult. The third thing that would give them power, tremendous power, right? The firmware basically controls the boot-up of the device, and it can launch other applications, it can deny things. So if you compromise that BIOS, in theory, you can reinstall a modified operating system, you can shut things on or off, you can do all sorts of things to control the rest of the machine. And again, this isn't easy, and that's why many of the, the malware teams haven't gone down to this level. But if they're able to pull it off, it is a huge potential risk. And this particular piece of malware started off really as kind of a banking malware going after the financial sector, but it has blossomed. It's, it's kind of like a Swiss Army knife now, and it's used in many different ways., you know, by attackers. In fact, there's a decent article by Hacker News and it kind of talks about how it's been picked up and used in different ways as a loader and so forth to bring in ransomware or deeper compromises, all sorts of different stuff. So this is a jack of all trades and that is very, very worrying. So security researchers right now are hot on the trail. They're trying to figure out, does this capability actually exist? And if so, what kinds of systems, what kind of firmware variants would it be impactful to? And okay, let's figure out then potentially how to either detect it, mitigate it, stop it. But again, right now the security researchers are really trying to figure out what capabilities and what risk this represents. But TrickBot and TrickBoot won't be the last. As these mechanisms evolve within the malware community, they tend to share it. And so we will start to see other families of malware go down to this level because again, the benefits to the attacker are tremendous. And it's going to be brand new headaches for security organizations and anti-malware companies and things of that sort to try and mitigate this and resolve it if a company or an organization is infected with this type of malware. So stay tuned. This could be a watershed moment when we're talking about malware development and how it could hit entire industries or companies or organizations and the response that the security industry is going to have to take to mitigate it.
