Huntress and MSP Remediate TrickBot Infection Across 23 Systems

Summary

Huntress and MSP Network Titan used assisted remediation to clean 23 systems affected by TrickBot, resolving 21 in under 20 minutes and the remaining two after they came online.

Key points

Huntress detected TrickBot on 23 of 55 systems in a client's network.
The assisted-remediation beta removed malicious scheduled tasks, services, and files from infected hosts.
Network Titan was also asked to disable Windows Administrative Shares and implement Software Restriction Policies to help prevent reinfection.
Huntress and Network Titan cleaned 21 infected hosts in under 20 minutes; the other two were offline and remediated after they came online.
The cleanup also required rebooting machines to remove non-persistent payloads; Administrative Shares were re-enabled afterward.

Article Details

Defense Focus: Rapidly contain and remediate an Emotet/TrickBot infection across affected client systems while reducing the risk of reinfection.
Detection Methods: Huntress detected TrickBot on 23 of 55 systems and generated a separate incident report for each affected host.
Data Sources: Huntress endpoint detections and host-specific incident reports
Platforms: Huntress
Defensive Actions: Use Assisted Remediation to remove malicious scheduled tasks, services, and files.
Disable Windows Administrative Shares during cleanup to help prevent reinfection.
Implement Software Restriction Policies to help block reinfection on cleaned systems.
Upgrade agents on affected hosts and approve the remediation plans.
Reboot machines to eliminate non-persistent payloads.
Re-enable Administrative Shares after cleanup.