New TrickBot Nworm Module

Summary

Researchers from Palo Alto Networks discovered a new TrickBot variant, dubbed nworm, that uses a stealthy malware spreading module to quietly infect Windows domain controllers. Unlike the old “mworm” module that sent TrickBot as an executable file without encryption or encoding, this new “nworm” module retrieves an encrypted or encoded binary. The malware is run from system memory without detection, leaving no artifacts and disappearing after a reboot or shutdown.

Recommendations

The NJCCIC recommends users avoid clicking on links, opening attachments, or enabling macros delivered with unexpected or unsolicited emails, and exercise caution with emails from known contacts. Indicators of compromise and technical details can be found in the Palo Alto Networks post.