COVID-19 Phishing Campaign Spreads TrickBot

Summary

TrickBot was first known as a banking trojan and evolved into a malware downloader. It can maintain persistence on infected systems and networks and operate with botnet-like capabilities. The latest tactic is a phishing campaign purporting to be from volunteer or humanitarian groups offering free COVID-19 medical advice and testing information contained in the attached document that, if opened and macros are enabled, installs the TrickBot trojan. In TrickBot campaigns, the malicious payload typically downloads after twenty seconds in order to evade detection or analysis.

Recommendations

The NJCCIC recommends users avoid clicking on links, opening attachments, or enabling macros delivered with unexpected or unsolicited emails, and exercise caution with emails from known contacts. Technical details can be found in the Microsoft Security Intelligence tweet and the Bleeping Computer post.