TrickBot Now Exploits Infected PCs to Launch RDP Brute Force Attacks

A new module for TrickBot banking Trojan has recently been discovered in the wild that lets attackers leverage compromised systems to launch brute-force attacks against selected Windows systems running a Remote Desktop Protocol (RDP) connection exposed to the Internet.

The module, dubbed “rdpScanDll,” was discovered on January 30 and is said to be still in development, said cybersecurity firm Bitdefender in a report shared with The Hacker news.

According to the researchers, the rdpScanDll brute-forcing module has so far attempted to target 6,013 RDP servers belonging to enterprises in telecom, education, and financial sectors in the U.S. and Hong Kong.

The malware authors behind TrickBot specialize in releasing new modules and versions of the Trojan in an attempt to expand and refine its capabilities.

“The flexibility allowed by this modular architecture has turned TrickBot into a very complex and sophisticated malware capable of a wide range of malicious activities, as long as there is a plugin for it,” the researchers said.

“From add-ons for stealing OpenSSH and OpenVPN sensitive data, to modules that perform SIM-swapping attacks to take control of a user’s telephone number, and even disabling Windows built-in security mechanisms before downloading its main modules, TrickBot is a jack-of-all-trades.”

How Does TrickBot RDP Brute-Force Module Work?

When TrickBot begins its execution, it creates a folder containing the encrypted malicious payloads and their associated configuration files, which includes a list of command-and-control (C2) servers with whom the plugin needs to communicate to retrieve the commands to be executed.

According to Bitdefender, the rdpScanDll plugin shares its configuration file with another module named “vncDll,” while making use of a standard URL format to communicate with the new C2 servers — https://C&C/tag/computerID/controlEndpoint

Here, “C&C” refers to the C2 server, “tag,” the group tag used by the TrickBot sample, “computerID,” the computer ID used by the malware, and “controlEndpoint,” a list of attack modes (check, trybrute and brute) and the list of IP address-port number combinations to be targeted via an RDP brute-force attack.