{
  "family": "trickster",
  "sample_count": 93,
  "category": "banking_trojan",
  "description": "Trickster (widely known across threat intelligence and cybersecurity communities under vendor detections including Trojan:Win32/Trickster, Trojan-Banker.Win32.Trickster, and TrickLoader) is a recognized alias and detection signature for TrickBot, the infamous modular banking trojan and malware loader operated by Russian-speaking cybercrime group WIZARD SPIDER (UNC1878). First emerging in late 2016 as a successor to Dyre, TrickBot/Trickster evolved from a financial credential stealer into one of the most sophisticated cybercrime frameworks in history, subject to official CISA Cybersecurity Advisory AA20-302A. Distributed via malicious spam (malspam) campaigns, weaponized Microsoft Office macro documents, and secondary infections from Emotet, Trickster deploys a modular architecture that dynamically downloads encrypted DLL modules from command-and-control servers. Its capabilities include web-inject banking credential theft, Active Directory and LDAP domain reconnaissance, lateral movement via EternalBlue (MS17-010) and SMB propagation, Mimikatz-based LSASS credential dumping, and staging high-impact enterprise ransomware families including Ryuk and Conti.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Trickster",
    "TrickBot",
    "TrickLoader",
    "Trojan-Banker.Win32.Trickster"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Trickster?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trickster is an alias and detection label for TrickBot, a sophisticated modular banking trojan and ransomware stager operated by WIZARD SPIDER."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor operates the Trickster / TrickBot infrastructure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is operated by the Russian-speaking cybercrime syndicate WIZARD SPIDER (also tracked as UNC1878 and Grim Spider)."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary ransomware strains are staged by Trickster?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Trickster acts as an initial access broker and loader for major ransomware operations, notably Ryuk and Conti."
      }
    },
    {
      "@type": "Question",
      "name": "Has the US Government published official advisories on Trickster / TrickBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, CISA, the FBI, and HHS issued Joint Cybersecurity Advisory AA20-302A detailing TrickBot and ransomware activity targeting critical infrastructure."
      }
    },
    {
      "@type": "Question",
      "name": "How does Trickster move laterally within enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It utilizes Mimikatz for credential harvesting, queries Active Directory, and propagates using SMB exploits like EternalBlue."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1055.001",
    "T1003.001",
    "T1021.002",
    "T1210",
    "T1087.002",
    "T1486",
    "T1071.001"
  ],
  "cisa_advisory": "AA20-302A",
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the continuous downloading of secondary payloads and the active exfiltration of telemetry.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any fake optimizers, rogue AV, or unknown applications installed recently.",
    "Deploy an enterprise-grade adware removal tool to locate and strip the deep registry hooks, scheduled tasks, and forced browser policies.",
    "Educate the user on recognizing deceptive malvertising and fake software updates, emphasizing that legitimate software does not use high-pressure scare tactics."
  ],
  "what_to_avoid": [
    "Do not allow the user to pay for any 'premium' license offered by the fake software; it is an extortion scam.",
    "Avoid assuming the endpoint is clean simply because the AV quarantined the initial installer; the user likely already executed it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft & Ransomware Precursor",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": "WIZARD SPIDER (UNC1878)",
  "delivery_mechanism": [
    "Malicious Spam (Malspam) with Weaponized Office Macros",
    "Emotet Droppers",
    "Spearphishing Campaigns"
  ],
  "target_platforms": [
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ],
  "capabilities": [
    "Modular DLL Injection",
    "Browser Web-Injects",
    "LSASS Credential Dumping",
    "Active Directory Reconnaissance",
    "Lateral Movement via SMB",
    "Ransomware Staging (Ryuk, Conti)"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Dynamic Link Library (DLL)",
      "Office Macro Document"
    ],
    "network_signatures": [
      "TLS-encrypted C2 communications over non-standard ports (447, 449)",
      "Encrypted configuration file exchange containing target banking URLs"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe",
      "Modular memory-only execution of secondary DLLs"
    ],
    "persistence_mechanisms": [
      "Scheduled tasks created via schtasks /create",
      "Windows Service creation with disguised names"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Enterprise domain controller compromise, massive financial theft, catastrophic ransomware encryption"
  },
  "lineage": {
    "derived_from": [
      "Dyre Banking Trojan",
      "Zeus Trojan Family"
    ],
    "variants": [
      "TrickBot Core",
      "TrickLoader",
      "Anchor"
    ]
  },
  "iocs": {
    "file_hashes": [
      "b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8",
      "4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b"
    ],
    "delivery": [
      "invoice_doc_macro.docm",
      "trickster_loader.exe"
    ],
    "persistence": [
      "schtasks /create /tn \"ServiceTest\" /tr \"%AppData%\\TrickBot\\client.exe\" /sc onlogon",
      "%AppData%\\TrickBot\\Data\\modules"
    ]
  },
  "sources": [
    {
      "name": "CISA Advisory AA20-302A - Ransomware Activity Targeting Healthcare (TrickBot)",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - TrickBot / Trickster",
      "url": "https://www.malwarebytes.com/threats/trickbot"
    }
  ]
}