Malware Mimics Famous WannaCry Virus To Worm Its Way Into Your Life

WannaCry and NotPetya are living in infamy. While there are no recent outbreaks of either of those making the news, one that appears to be playing copycat has made the cybersecurity headlines recently. Trickbot, which is an evolution of the now defunct Dyre banking trojan is using a trick from the others to do even more damage. It’s worming its way through infected networks attempting to scan the domains for vulnerable servers and computers.

The security vendor, Flashpoint discovered this iteration of Trickbot and says it’s still being sent in spam with a spoofed sender address that appears to be from an international financial services company.

Remember to pay attention to email messages that arrive in your inbox, regardless of who the sender appears to be. It’s not difficult to make the name that shows up appear as if it’s someone you know or with whom you do business. However, if you receive something unexpected, from an unknown sender, or just feel strange about something with regard to the message, investigate it further before clicking links or attachments that may be inside.

Unfortunately, even that isn’t foolproof anymore. A recent campaign was discovered that uses senders with a subject line that appears to be a reply to your email. Those were disguised as status updates and included links that looked as if they could be tracking numbers or shipping information. Those also took users to sites that installed malware.

However, taking an extra few seconds to take a deep look is still the best first way to avoid becoming the next phishing victim. Hover over the link with the mouse pointer (hold your finger on it for several seconds if on a tablet or smartphone), open the full address of the sender by clicking it, and look for typos. If there is ever any doubt, contact the senders using your own contact information for them and verify it.

In the case of this version of Trickbot, Flashpoint analysts have not found any evidence yet that it’s being used to worm its way around a network. However, they do suspect the authors may be testing it to find out how to use machines it infects to create a botnet.