The authors of the Trickbot banking Trojan have once again begun using URL redirection instead of malicious email attachments to spread their malware. It is the latest example of how cybercriminals constantly evolve — and sometimes recycle — their tactics to stay ahead of defenders.

Security researchers from Trend Micro on Monday said they had recently discovered a new variant of Trickbot arriving via redirection URL in a spam mail message. The URL appears to point toward a Google domain but instead redirects users who click on it to a site that downloads Trickbot on the user's system.

The content of the spam email purports to be about a processed order that is ready for shipping, Trend Micro said. The email contains what appears to be a tracking number for the package, standard delivery disclaimers, contact details of the purported sender, and even social media icons for lending additional authenticity to the email.

If a user gets tricked into clicking on the embedded URL in the email, the user is routed to a Trickbot download site that is designed to appear like a Web page for reviewing online orders.

The site downloads a compressed file that contains a Visual Basic Script for downloading Trickbot. Once the malware is executed on the system, it quickly deploys additional modules for various tasks, such as stealing browser data, injecting malicious code into browsers for monitoring online banking activity, searching through files on the infected machine, and profiling the network.

"Utilizing a URL redirection from a known domain is a tactic used by other bad actors to fool unsuspecting victims into thinking the embedded URL within an email is legitimate," says Jon Clay, marketing manager at Trend Micro.

The developers of Trickbot know that many users might do a cursory review of the embedded URLs and are more likely to click on them if they see a legitimate domain. They also know that many users are accustomed to seeing redirect notices when pop-ups appear and are therefore unlikely to be alarmed when they see the requests, Clay says.

"The significance of this new tactic is that, once again, the developers of Trickbot — and many other malware families — are constantly shifting their attack strategies to not only fool their victims, but also to make it more difficult for security solutions to detect their threat," he says.

A Persistent Threat
Trickbot first surfaced in 2016 and has remained a major threat ever since to online banking customers in several countries, including the US, UK, and Australia. In the US, the malware has targeted users of numerous major banks and credit card companies, including Chase, Bank of America, American Express, and Discover.

Security researchers have described the malware as being sophisticated, stealthy, and capable of evading sandboxes and other detection and blocking measures. Among other things, Trickbot is designed to steal the usernames and passwords that people use for accessing their online banking accounts and transmit the credentials to the criminals behind the operation so it can be used to steal money.

In the first quarter of 2019, Trickbot was among the most active banking Trojans in the wild, according to Trend Micro's data. The only other banking malware that was consistently more active during that period was Emotet.

Trickbot's operators have typically distributed the malware via malicious attachments in spam email. The attachments — usually a Microsoft Word or an Excel document — appear to be an invoice or other financial statement that prompt users to enable macros, which then download and execute the malware. However, they have also used URL redirection in the past to spread the malware.

Threat actors often use redirection as a way to get around Web reputation technologies that are becoming increasingly better at detecting malicious URLs, Clay says. In some cases, Trend Micro has observed adversaries using multiple redirects as part of the infection chain in an effort to thwart security detections, he says. 

"Bad actors are looking to compromise legitimate Web pages and install redirects more and more as it has been an effective strategy to evade detection," Clay notes.

The trend highlights the need for organizations to have capabilities for assessing Web reputation and scanning for embedded URLs within emails. They also need to be able to detect and analyze multiple redirects during a session, Clay says. In addition, organizations need to educate users on how to recognize illegitimate pop-ups and on the danger of enabling Macros in a pop-up, he says.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.