The US Cyber Command, the Defense Department division in charge of its cyberspace operations, recently mounted an operation to disrupt one of the most massive and notorious botnets today. According to The Washington Post, CyberCom successfully (albeit temporarily) interrupted the Trickbot botnet’s operations at least a couple of times over the last few weeks. The botnet is composed of at least a million hijacked computers infected with the Trickbot malware and reportedly run by Russian-speaking criminals.
KrebsonSecurity, which was the first to report on the disruptions, the entity that interrupted the botnet sent infected computers a command that disconnected them from the servers Trickbot’s operators used to control them. Also, the entity filled the Trickbot database with bogus records to confuse the operators. At the time, Krebs didn’t have information on who or what was responsible.
The Trickbot malware can be used to steal sensitive information, such as financial data and login credentials, and the botnet can be used to infect systems with ransomware. Just this September, the botnet was used against healthcare provider Universal Health Services in an attack that locked up its network with a ransomware called Ryuk.
The Post’s report suggests that CyberCom’ actions are part of its efforts to protect the 2020 Presidential Election against foreign interference. Gen. Paul Nakasone, head of CyberCom, told The Post in a statement back in August:
“Right now, my top priority is for a safe, secure, and legitimate 2020 election The Department of Defense, and Cyber Command specifically, are supporting a broader ‘whole-of-government’ approach to secure our elections.”
That said, the group didn’t cause permanent harm to the botnet’s operations. Krebs says Trickbot operators have already started rebuilding the botnet. Hold Security’s Alex Holden also told the expert that “their ransomware operations are pretty much back in full swing” and that they’re even looking to demand more money from victims to recoup their losses.