TrickBot Adds TrickBoot Module for Firmware Attacks

Summary

Huntress reported new TrickBot functionality, dubbed TrickBoot, that can identify firmware vulnerabilities and may read, write, or erase device firmware. The article outlines indicators, attack flow, and Huntress’s detection efforts.

Key points

• Huntress reported that TrickBoot is a new TrickBot module capable of identifying firmware vulnerabilities and, where possible, reading, writing, or erasing firmware.
• The article warns that firmware-level persistence could allow attackers to regain access after an operating-system wipe and potentially render a device unusable.
• Suggested indicators include randomly named scheduled tasks or services, the RWEverything driver RwDrv.sys, and, on older Windows systems, TrickBot modules in a random %APPDATA% subdirectory.
• The described attack flow includes initial access through emails carrying an Emotet dropper, scheduled-task persistence, privilege escalation, lateral movement, and downloading additional modules.
• Huntress said it had not observed affected systems among its customers at the time of publication and was conducting a retrospective hunt.
• Huntress said it created a detector to identify misuse of the legitimate RWEverything driver; the article also recommends patching firmware and UEFI/BIOS and maintaining defenses against the described infection chain.

MITRE ATT&CK

People

Malware

Vendors

Related Articles

• Talos Roundup Details Prevalent Malware Threats and Indicators of CompromiseEmotet · TrickBot · T1566.001
• How Human Analysts and Automation Work Together to Hunt ThreatsEmotet · TrickBot · T1053.005
• Report Details How Malware Crypting Services Help Threat Actors Evade DetectionTrickBot · T1053.005 · T1566.001
• Huntress Reports Emotet on 99 of 120 Client MachinesEmotet · T1053.005 · T1566.001
• Huntress Adds Host Isolation to Contain Malware on Windows HostsEmotet · TrickBot