Microsoft goes after TrickBot
Microsoft and partners used a court order to disrupt TrickBot’s servers. The malware will try to come back.
Yesterday Microsoft and several partners announced they had disrupted TrickBot, one of the biggest botnets, using a court order to take down its servers. TrickBot infects computers, steals credentials, and sells access to ransomware gangs, especially Ryuk.
Disruptions like this help, but botnet operators rebuild. The infected computers are still out there.
What to do in your own network:
- Check your security tools for TrickBot or Emotet detections in the past months. Those machines were the entry point for ransomware.
- Reset passwords used on any machine that was infected.
- Block macros from the internet and suspicious attachments. That’s how most TrickBot infections start.
- Watch for lateral movement, like new admin logins on many machines.
An infection that “was cleaned” months ago can be the reason for ransomware today.