CSIAC

Cyber Security and Information Systems Information Analysis Center

/ CSIAC Reports / Examination of Emotet’s Activities: TrickBot Takes Over as Top Organizational Threat

Examination of Emotet’s Activities: TrickBot Takes Over as Top Organizational Threat

| 2 Comments


Watch the companion video podcast to this report to learn more about TrickBot. https://www.csiac.org/podcast/trickbot

Abstract:

Today’s cyber threat is more advanced, persistent and capable. The constantly changing cyber landscape creates more fundamental gaps when it comes to conducting traffic analysis and identifying intrusion detection. These fundamental gaps are ubiquitous across the current commercial technology landscape and make organizations susceptible to zero-day exploits. Cybercriminals have identified many methods to exploit browser applications and steal credentials that are typed by the users. These types of cybercriminals and methods are known as information stealers. The most common form of information stealer gathers login information such as usernames and passwords using keyloggers, which are designed to capture user keystrokes. The Trojan malwares, specifically, Emotet and Trickbot, act as information stealers by targeting windows-based computers and banking customers. In a recent troublesome development, the ubiquitous Emotet botnet has re-emerged with a new module that siphons email messages from machines infected by the malware.

The rest of this report will be released shortly, thank you for your patience.

Authors

Steve Warzala
Steve Warzala
Mr. Warzala is a Senior Program Manager with Quanterion Solutions Incorporated (QSI) and serves as the CSIAC Outreach Manager. He has nearly 40 years of experience in defining, developing and managing novel research and development (R&D) projects to provide solutions for critically challenging scientific and technical (S&T) problems. His areas of technical specialty include fault tolerant computing, parallel processing and secure computer information systems and networks. Mr. Warzala has served in a variety of functional capacities with Government agencies, commercial organizations and academic institutions. He has a Computer Science degree from Syracuse University and completed extensive graduate coursework in Computer Engineering, Information Science as well as Engineering Management.
Charlie Merulla
Charlie Merulla
Twenty-Five years' experience in the Information Technology Field working Information Assurance and System/Network Administration. Experience with Cisco IOS, switches/hubs, VPN's, VLAN's, network protocols, IPv6, Windows, and various flavors of Linux operating systems. Migrated numerous DoD systems from DoD Information Assurance Certification and Accreditation (DIACAP) process to the DoD mandated Risk Management Framework (RMF) process, utilizing the Enterprise Mission Assurance Support Service (eMASS) system and Telos Xacta. Presently certified in DoD 8570 IAM Level III.; held other IAT Level III certifications.
Roderick A. Nettles
Roderick A. Nettles
Mr. Roderick A. Nettles is currently serving as the Deputy Director under our current Cyber Security and Information Systems IAC (CSIAC) Basic Center Operations (BCO) contract, developing/implementing means of improving/assuring performance with existing resources to meet and exceed the customer’s requirements. Mr. Nettles is responsible for leading Quanterion efforts to develop and maintain a viable training program under the CSIAC BCO contract using a mix of company, subcontractor and subject matter expert instructed courses. In addition, serving as the Chief Editor of a cybersecurity journal. Responsible for managing all the day-to-day operations of a quarterly publication. As the editor-in-chief, oversee the editorial board and peer-review team of the quarterly publication and ensures each issue is released on time. Mr. Nettles has a bachelor’s degree in Computer Science and Master in Information Technology Management. He has over 20 years of oversight of Cyber Command and Control Mission System weapon system to include Automated Information Systems which enables mission by synchronizing other cyber weapon systems to produce operational level effects in support of Combatant Commanders worldwide. Mr. Nettles was assigned to CONUS NORAD Region (CONR) 1AF/A6 at Tyndall Air Force Base as the Office In Charge , Command and Control Systems Branch. He was responsible for developing cyber defense Table Top Exercise; validated C2 Tactics, Techniques and Procedures with Twenty-Fourth Air Force (24AF), 33d Network Warfare Squadron (33NWS), Canadian Forces Network Operations Centre (CFNOC), Canadian NORAD Region (CANR) & 5 Air Defense Sectors to hardened NOARD's front line Command and Control Systems. Mr. Nettles was charged with eliminating security vulnerabilities systems—secured C2 mission systems. As the Chief of C2 Systems Branch, Mr. Nettles bridged CANR, CONR & 6 sectors to Defensive Cyber Operations combat methodologies. As a Cyber Operational Planner, he led efforts to identify mission key terrain, "Mapped the Mission” for NORAD Network Enterprise.

Reader Interactions

Comments

  1. Thank you for sharing.
    i would like to say that although organizations with decent spam filtering, proper system administration, and up-to-date Windows hosts have a much lower risk of infection, more investigation is needed for applicable indicators for further strengthen our threat prevention platform.

Leave a Comment