TrickBot Banking Trojan Introduces RDP Brute Forcing Module

Malicious actors have created a new module for the TrickBot banking trojan that allows the malware to perform brute force attacks on Microsoft’s Remote Desktop Protocol, specifically targeting U.S. and Hong Kong IP addresses.

The module, called rdpScanDll, primarily focuses on the telecommunications, education, and financial services sectors, according to a new white paper from Bitdefender’s Cyber Threat Intelligence Lab, authored by researcher Radu Tudorica and co-authored by team leader Alexandru Maximciuc and senior team leader Cristina Vatamanu.

Discovered on Jan. 30, rdpScanDll is still in development — in fact, researchers studying a sample of the module found that one of its attack modes was broken. But even so, the module adds even more functionality to TrickBot’s diverse arsenal of cyber weapons.

The trojan’s original purpose was for harvesting banking credentials, but thanks to its plug-in nature it can now also incorporate modules for a variety of purposes including lateral movement, reconnaissance, data collection and exfiltration and more. In its new paper, Bitdefender reports that plug-ins enabling lateral movement were the most frequently updated category of TrickBot modules over the last six months.

TrickBot is currently distributed largely via spam by the Emotet botnet, and has been recently used in campaigns in conjunction with Ryuk ransomware.

“The new rdpScanDll module may be the latest in a long line of modules that have been used by the TrickBot Trojan, but it’s one that stands out because of its use of a highly specific list of IP addresses,” the white paper states. “While the module seems to be under development, as one attack mode seems broken, newer versions of rdpScanDll will likely fix this and potentially add new ones.”