Trickbot
software trojan
Trickbot was a trojan for Microsoft Windows and other operating systems. Its major function was originally the theft of banking details and other credentials, but its operators have extended its capabilities to create a complete modular malware ecosystem.
Capabilities
Trickbot was first reported in October 2016. It is propagated by methods including executable programs, batch files, email phishing, Google Docs, and fake sexual harassment claims.
The Web site Bleeping Computer has tracked the evolution of TrickBot from its start as a banking Trojan. Articles cover its extension to attack PayPal and business customer relationship management (CRM; June 2017), the addition of a self-spreading worm component (July 2017), coinbase.com, DKIM support to bypass email filters, steal Windows problem history, steal cookies (July 2019), targets security software such as Microsoft Defender to prevent its detection and removal (July 2019), steal Verizon Wireless, T-Mobile, and Sprint PIN codes by injecting code when accessing a Web site (August 2019), steal OpenSSH and OpenVPN keys (November 2019), spread malware through a network (January 2020), bypass Windows 10 UAC and steal Active Directory credentials (January 2020), use fake COVID-19 emails and news (since March 2020), bypass Android mobile two-factor authentication, checks whether it is being run in a virtual machine (by anti-malware experts; July 2020), infecting Linux systems (July 2020).
TrickBot can provide other malware with access-as-a-service to infected systems, including Ryuk (January 2019) and Conti ransomware; the Emotet spam Trojan is known to install TrickBot (July 2020).
In 2021, IBM researchers reported that trickbot had been enhanced with features such as a creative mutex naming algorithm and an updated persistence mechanism.
Infections
On 27 September 2020, US hospitals and healthcare systems were shut down by a cyber attack using Ryuk ransomware. It is believed likely that the Emotet Trojan started the botnet infection by sending malicious email attachments during 2020.
This brief starts where responsible research should: with the source description of “Trickbot” as software trojan. Everything that follows is an evidence route, not borrowed authority.
Why this record matters
The subject matters to the science & nature register because the source frames it as software trojan. Its deeper value depends on whether names, dates, institutions and citations support that framing.
Stable identifiers, scientific names and standards terminology offer the best bridge between this overview and specialist evidence. The source revision retrieved here is dated Sep 16, 2026. The linked authority identifier is Q99796462. None of the 1 selected statements returned an explicit reference. The first chronological checks are 2016, 2017, 2019 and 2020.
Scientific names, classifications and consensus can change while older terminology persists in catalogues and historical literature. The lead is largely declarative, so disagreement and counter-evidence require a deliberate search beyond the opening account. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Check terminology, classification and the date of the cited evidence. Scientific names and technical consensus can change while older records retain historical value.
- Current terminology
- Classification context
- Finding cited technical literature
Primary datasets, specimen catalogues, standards bodies and the most recent peer-reviewed literature.
Three-step research path
- Establish the record: confirm the title “Trickbot”, its source revision and the description used here.
- Expand the search: follow Trickbot primary sources, Trickbot archive and Trickbot research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “Trickbot”?
- Is the terminology current, historical or disputed?
- Which observation, specimen, dataset or publication supports the account?
Search terms from this dossier
This entry incorporates text from “Trickbot” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.